CVE-2026-55824

Name of the Vulnerable Software and Affected Versions Contao versions 4.13.40 through 5.3.46 Contao versions 5.7.0-RC1 through 5.7.6

Description The crawler in this Open Source CMS leaks authentication credentials to external hosts. The system attempts to protect confidential HTTP client options by using a scoped client that removes Cookie and Authorization headers for external domains. However, the cleaner incorrectly targets the option names basic auth and bearer auth instead of the actual Symfony HttpClient options auth basic and auth bearer. Consequently, if contao.crawl.default http client options contains Basic or Bearer authentication for a protected site, these credentials are sent to external links or configured additional URIs. An attacker can capture these credentials by inducing the crawler to visit an external URL, such as through a link on a page while the broken-link checker is active.

Recommendations Update to version 5.3.47. Update to version 5.7.7.