CVE-2026-107842: Contao Core Bundle - Disclosure of Protected Page Content to Anonymous Visitors
Summary
CVE-2026-107842: ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.index_protected, but the authorisation data lives per row in tl_search. Affects contao/core-bundle across 2 version ranges.
>= 4.0.0, < 5.3.50
>= 5.4.0-RC1, < 5.7.12
Fixed in 5.3.50 or 5.7.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that allows users to create and manage websites with ease. It offers a range of features including a user-friendly interface, flexible templating, and extensive customization options. The Contao Core Bundle is a critical component of this CMS, providing essential functionalities for managing content and user access. However, a vulnerability has been identified that affects the security of protected page content, allowing unauthorized access to certain information.
Vulnerability Detail
The vulnerability arises from the ModuleSearch component, which determines whether to filter protected pages from search results based on the contao.search.index_protected setting. When this setting is disabled, the filter is removed, but the authorization data remains in the tl_search table. As a result, protected page titles, URLs, and snippets can be disclosed to unauthenticated visitors through search results, even though access to the actual pages is still restricted (returning a 401 status). This leads to the unintended exposure of sensitive information, posing a risk to user privacy and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 5.3.505.3.50composer require contao/core-bundle:5.3.50 -
>= 5.4.0-RC1, < 5.7.125.7.12composer require contao/core-bundle:5.7.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can keep the contao.search.index_protected setting enabled to prevent the disclosure of protected page information until the package is updated. This will ensure that protected pages are filtered out from search results.
Conclusion
The vulnerability CVE-2026-107842 in the Contao Core Bundle poses a risk by disclosing protected page content to unauthorized users through search results. It is crucial for users to update their installations to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for contao/core-bundle →
FAQ
The vulnerability allows unauthorized users to see titles, URLs, and snippets of protected pages through search results, which could lead to privacy concerns.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of the Contao Core Bundle prior to 5.3.50 on the 4.x branch and prior to 5.7.12 on the 5.x branch are affected by this vulnerability.
Yes, updating to the specified patched versions of the Contao Core Bundle will permanently fix the vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
