Contao CMS: Cross-Site Request Forgery in Custom Back End Actions

Presentation

Contao dispatches a family of back office operations through a key parameter on the request, a mechanism also used by custom extensions to register their own actions.

HDW Sec found that this dispatch family does not require the anti-CSRF request token, so a back office user can be made to trigger these actions by visiting an attacker-controlled page.

Issue(s)

• The actions reached through the dispatch parameter are state-changing but do not verify the REQUEST_TOKEN that protects the rest of the back office.
• An authenticated back office user only has to load an external page for the action to fire in their session.
• The same gap applies to custom actions registered by third-party extensions, which inherit the dispatch mechanism and its missing check.
• Impact is bounded to integrity, and user interaction is required, which is why the score stays low.

References

• GitHub advisory: GHSA-9ff2-p842-45wq
• Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.