CVE-2026-107842

MEDIUM 5.3

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

CWE	CWE-200
Vendor	contao
Product	contao
Published	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for contao contao

Be the first to know when new medium vulnerabilities affecting contao contao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

contao / contao

>= 4.0.0, < 5.3.50 >= 5.4.0-RC1, < 5.7.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq github.com: https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457 github.com: https://github.com/contao/contao/releases/tag/5.3.50 github.com: https://github.com/contao/contao/releases/tag/5.7.12