{"action":"Upgrade contao/contao to 5.3.47 or later.","affected":[{"fixed":"5.3.47","introduced":"4.13.0"},{"fixed":"5.7.7","introduced":"5.4.0"}],"component":"contao/contao","cve_ids":["CVE-2026-55824"],"ecosystem":"Packagist","epss":0.00243,"exploited":false,"fixed_versions":["5.3.47","5.7.7"],"ghsa_id":"GHSA-3mr9-p497-58f6","id":"tcs_01M5KET4D2WHTNHNE00EV9PJ44","modified_at":"2026-08-06T19:45:16.256360775Z","published_at":"2026-08-06T19:43:02Z","references":["https://osv.dev/vulnerability/GHSA-3mr9-p497-58f6","https://github.com/contao/contao/security/advisories/GHSA-3mr9-p497-58f6","https://nvd.nist.gov/vuln/detail/CVE-2026-55824","https://github.com/contao/contao/commit/5bc6e3f900c439313df57aa561d0865792aafa05","https://github.com/contao/contao/commit/80425d28cdf66280a209bd3f5bc31b1a76901a04","https://contao.org/en/security-advisories/credentials-disclosure-in-the-crawler","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2026-55824.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2026-55824.yaml","https://github.com/contao/contao"],"severity":{"label":"low","score":2.6},"sources":[{"source":"osv","source_id":"GHSA-3mr9-p497-58f6","url":"https://osv.dev/vulnerability/GHSA-3mr9-p497-58f6"}],"summary":"Contao crawler leaks auth credentials to external hosts"}