[LOW] Contao: Cross-site request forgery in custom backend actions

PKSA-6ymc-kdpm-qx87 CVE-2026-107848 GHSA-9ff2-p842-45wq

Affected package: contao/core-bundle

Affected version: >=5.4.0-RC1,<5.7.12|>=4.0.0,<5.3.50

Reported by:
GitHub