{"metadata": {"vulnerability": "CVE-2026-107848", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-08T22:34:49.291Z", "date_only": false, "value": "2026-10-08T22:34:49.291Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107848", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-09T20:22:12.778Z", "date_only": false, "value": "2026-10-09T20:22:12.778Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107848", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-09T20:22:12.778Z", "date_only": false, "value": "2026-10-09T20:22:12.778Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-107848", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T20:36:58.435Z", "date_only": false, "value": "2026-10-09T20:36:58.435955Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117412870092016314", "record": "CVE-2026-107848", "field": "creation_timestamp", "uuid": "05644c6c-7bb4-466c-95a9-15fc4e9bbb5f", "content": "CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107848https://github.com/contao/contao/security/advisories/GHSA-9ff2-p842-45wqhttps://github.com/contao/contao/commit/34dd27ee6739f10568d3d95d8784862255c925b4https://github.com/contao/contao/releases/tag/5.7.12#contao#CVE_2026_107848#bot", "url": "https://infosec.exchange/users/cve/statuses/117412870092016314"}, {"timestamp": "2026-10-09T20:54:00Z", "date_only": false, "value": "2026-10-09T20:54:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9FF2-P842-45WQ", "record": "GHSA-9FF2-P842-45WQ", "field": "published"}, {"timestamp": "2026-10-09T20:54:00Z", "date_only": false, "value": "2026-10-09T20:54:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9FF2-P842-45WQ", "record": "GHSA-9FF2-P842-45WQ", "field": "modified"}, {"timestamp": "2026-10-09T21:17:02.617Z", "date_only": false, "value": "2026-10-09T21:17:02.617", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107848", "record": "FKIE_CVE-2026-107848", "field": "published"}, {"timestamp": "2026-10-10T20:30:29Z", "date_only": false, "value": "2026-10-10T20:30:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/f797a798bc89f290dbc7f5bab9510361", "record": "CVE-2026-107848", "field": "creation_timestamp", "uuid": "19fa64f6-f284-46d9-97f0-689e2af31c76", "content": "# CVE-2026-107848: CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests\n\n> **CVSS Score:** 3.5\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107848\n\n## Summary\nContao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The `RequestTokenListener` component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an `act` parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as `key=` can execute without CSRF token verification when triggered by an authenticated user.\n\n## TL;DR\nContao CMS fails to validate anti-CSRF tokens for custom backend GET actions using query parameters like `key=`. An attacker can trick an authenticated backend user into visiting a crafted URL to execute unauthorized state-changing operations within the user's permission scope.\n\n## Technical Details\n\n- **CWE ID**: CWE-352 (Cross-Site Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 3.5 (Low)\n- **EPSS Score**: 0.00113 (1.34th percentile)\n- **Impact**: Low Integrity Impact (State-changing backend operations)\n- **Exploit Status**: None / No public functional exploit\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Contao Open Source CMS (contao/contao) >= 4.0.0, < 5.3.50\n- Contao Open Source CMS (contao/contao) >= 5.4.0-RC1, < 5.7.12\n- **contao/contao**: >= 4.0.0, < 5.3.50 (Fixed in: `5.3.50`)\n- **contao/contao**: >= 5.4.0-RC1, < 5.7.12 (Fixed in: `5.7.12`)\n\n## Mitigation\n\n- Upgrade Contao CMS to version 5.3.50, 5.7.12, or higher.\n- Enforce HTTP POST method on all custom state-changing DCA actions (`key=`).\n- Implement explicit `ContaoCsrfTokenManager::isTokenValid()` verification in custom controller handlers.\n- Configure backend session cookies with `SameSite=Strict` or `SameSite=Lax` attributes.\n\n**Remediation Steps:**\n1. Run `php composer.phar update contao/contao` to pull the latest security fixes.\n2. Audit custom third-party extensions for GET-based backend actions using `key=` query parameters.\n3. Update custom DCA definitions to require `'method' => 'POST'` for state-changing operations.\n4. Clear application cache and verify backend operation behavior.\n\n## References\n\n- [GitHub Security Advisory GHSA-9ff2-p842-45wq](https://github.com/contao/contao/security/advisories/GHSA-9ff2-p842-45wq)\n- [Patch Commit 34dd27ee6739f10568d3d95d8784862255c925b4](https://github.com/contao/contao/commit/34dd27ee6739f10568d3d95d8784862255c925b4)\n- [Contao v5.7.12 Release Notes](https://github.com/contao/contao/releases/tag/5.7.12)\n- [NVD CVE-2026-107848 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-107848)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107848) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/f797a798bc89f290dbc7f5bab9510361"}, {"timestamp": "2026-10-13T11:20:04.775Z", "date_only": false, "value": "2026-10-13T11:20:04.775608Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107848", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T11:20:04.775Z", "date_only": false, "value": "2026-10-13T11:20:04.775608Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107848", "record": "FKIE_CVE-2026-107848", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T11:20:32.388Z", "date_only": false, "value": "2026-10-13T11:20:32.388Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107848", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T11:20:32.388Z", "date_only": false, "value": "2026-10-13T11:20:32.388Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107848", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T12:17:11.947Z", "date_only": false, "value": "2026-10-13T12:17:11.947", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107848", "record": "FKIE_CVE-2026-107848", "field": "lastModified"}]}