CVE-2026-107851 Details
Description
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.
A vulnerability in Contao's core-bundle TableAccessVoter has been identified, affecting versions 5.7.0 prior to 5.7.12. The issue arises from the voter caching authorization decisions based solely on the user's security token hash, without considering the specific database table involved. This flaw enables a low-privileged backend user to exploit the caching mechanism. By first accessing a table they are permitted to view and subsequently querying a denied table, the voter can incorrectly grant access. As a result, the user may gain unauthorized read, create, update, or delete rights on records in tables beyond their assigned module permissions, including sensitive data such as member or newsletter subscriber information.
Users can upgrade to Contao version 5.7.12 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/contao/contao/commit/9d6f582a4cc6a758ce11d1043fc9c0ba62c5f4c9 | [email protected] | Source CodeVendor |
| https://github.com/contao/contao/releases/tag/5.7.12 | [email protected] | Release NotesVendor |
| https://github.com/contao/contao/security/advisories/GHSA-5974-gfqc-wrcm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Contao | >= 5.7.0, <= 5.7.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |