CVE-2026-107845

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

Contao from version 4.0.0 to 5.3.50 and 5.7.12 has a CSRF vulnerability because RequestTokenListener validates the token only for POST requests, and the GET guard runs only when an act parameter is present. Backend actions via the key parameter can execute without a CSRF token when an authenticated user loads a malicious URL. Fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 5.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ImagesController that joins the user-controlled {path} parameter to the image target directory without verifying the canonical path stays within that directory. An unauthenticated attacker can use encoded parent-directory segments to access files under the project directory if their extensions are allowed. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.1.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleRegistration::compile() that allows the follow-up registration branch to be entered on any POST to a page with the registration module without verifying FORM_SUBMIT or the captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to send repeated activation emails and determine if a pending registration exists. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleSearch that can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.

Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.

Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.

Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.