CVE-2026-107842 Details
Description
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.
A vulnerability in Contao's ModuleSearch feature can lead to the unauthorized disclosure of protected page titles, URLs, and indexed context snippets. This issue affects Contao versions 4.0.0 through 5.3.50 and 5.7.12. The vulnerability arises because the search module's behavior is controlled by the 'contao.search.index_protected' setting. When this setting is disabled, the module fails to filter out protected pages that were indexed while the setting was enabled. Although the pages themselves remain access-controlled, the search metadata and indexed text are exposed to unauthenticated visitors.
Users can upgrade to Contao versions 5.3.50 or 5.7.12 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457 | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/releases/tag/5.3.50 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/releases/tag/5.7.12 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |