Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

PKSA-8zc2-xpjt-dfrb

Affected package: contao/contao

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories