CVE-2026-55824

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-55824

Contao CVE-2026-55824 affects the crawler in versions 4.13.40–5.3.46 and 5.7.0-RC1–5.7.6. The issue arises because the crawler’s cleanup logic preserves root-origin options but strips out non-Symfony option names basic_auth and bearer_auth instead of Symfony’s auth_basic and auth_bearer, leaving ...