Contao is an Open Source CMS

Overview

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony option names basic_auth and bearer_auth instead of Symfony HttpClient's real auth_basic and auth_bearer options. When contao.crawl.default_http_client_options contains Basic or Bearer authentication for a protected staging/production site, those credentials remain in the "clean" client used for external links or configured additional URIs. An attacker who can get an external URL crawled, for example through a link on a crawled page while the broken-link checker is enabled, can receive the crawler credentials. This issue has been fixed in versions 5.3.47 and 5.7.7.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-55824)

Affected packages:

• contao/contao >= 4.13.0, < 5.3.47
• contao/contao >= 5.4.0, < 5.7.7
• contao/core-bundle >= 4.13.0, < 5.3.47
• contao/core-bundle >= 5.4.0, < 5.7.7

Patched in:

• contao/contao 5.3.47
• contao/contao 5.7.7
• contao/core-bundle 5.3.47
• contao/core-bundle 5.7.7

Source: https://github.com/advisories/GHSA-3mr9-p497-58f6