All vulnerabilities
CVE-2026-107842GHSA-x2rp-9qf7-2fmq

contao/core-bundle: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

contao contao/core-bundlecomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.3.50Also 5.7.12GitHub
Published9 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

  • 5.3.50contao/core-bundle, composerGitHubcomposer require "contao/core-bundle:^5.3.50"
  • 5.7.12contao/core-bundle, composerGitHubcomposer require "contao/core-bundle:^5.7.12"
  • 5.3.50contao/core-bundle, PackagistOSVcomposer require "contao/core-bundle:^5.3.50"
  • 5.7.12contao/core-bundle, PackagistOSVcomposer require "contao/core-bundle:^5.7.12"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.index_protected, but the authorisation data lives per row in tl_search. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed while it was on are returned to unauthenticated visitors such as title, URL and context snippet, even though the pages themselves still answer 401.

Impact

Disclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass.

Credits

This security vulnerability was found by @iRevivalx .

Text from GitHub Advisory Database

Affected versions 106

  • contao/core-bundle, composer>= 4.0.0, < 5.3.50GitHub
  • contao/core-bundle, composer>= 5.4.0-RC1, < 5.7.12GitHub
  • contaoaffected: >= 4.0.0, < 5.3.50CVE List
  • contaoaffected: >= 5.4.0-RC1, < 5.7.12CVE List
  • contao/core-bundle, Packagistfrom 4.0.0, fixed in 5.3.50OSV
  • contao/core-bundle, Packagist4.0.0OSV
  • contao/core-bundle, Packagist4.0.1OSV
  • contao/core-bundle, Packagist4.0.2OSV
  • contao/core-bundle, Packagist4.0.3OSV
  • contao/core-bundle, Packagist4.0.4OSV
  • contao/core-bundle, Packagist4.1.0OSV
  • contao/core-bundle, Packagist4.1.0-RC1OSV
  • contao/core-bundle, Packagist4.1.0-beta1OSV
  • contao/core-bundle, Packagist4.1.1OSV
  • contao/core-bundle, Packagist4.1.2OSV
  • contao/core-bundle, Packagist4.1.3OSV
  • contao/core-bundle, Packagist4.10.0OSV
  • contao/core-bundle, Packagist4.10.0-RC1OSV
  • contao/core-bundle, Packagist4.10.0-RC2OSV
  • contao/core-bundle, Packagist4.10.0-RC3OSV
  • contao/core-bundle, Packagist4.10.0-RC4OSV
  • contao/core-bundle, Packagist4.10.1OSV
  • contao/core-bundle, Packagist4.10.2OSV
  • contao/core-bundle, Packagist4.10.3OSV
  • contao/core-bundle, Packagist4.10.4OSV
  • contao/core-bundle, Packagist4.10.5OSV
  • contao/core-bundle, Packagist4.10.6OSV
  • contao/core-bundle, Packagist4.10.7OSV
  • contao/core-bundle, Packagist4.11.0OSV
  • contao/core-bundle, Packagist4.11.0-RC1OSV
  • contao/core-bundle, Packagist4.11.0-RC2OSV
  • contao/core-bundle, Packagist4.11.1OSV
  • contao/core-bundle, Packagist4.11.2OSV
  • contao/core-bundle, Packagist4.11.3OSV
  • contao/core-bundle, Packagist4.11.4OSV
  • contao/core-bundle, Packagist4.11.5OSV
  • contao/core-bundle, Packagist4.11.6OSV
  • contao/core-bundle, Packagist4.11.7OSV
  • contao/core-bundle, Packagist4.11.8OSV
  • contao/core-bundle, Packagist4.11.9OSV
  • contao/core-bundle, Packagist4.12.0OSV
  • contao/core-bundle, Packagist4.12.0-RC1OSV
  • contao/core-bundle, Packagist4.12.0-RC2OSV
  • contao/core-bundle, Packagist4.12.0-RC3OSV
  • contao/core-bundle, Packagist4.12.1OSV
  • contao/core-bundle, Packagist4.12.2OSV
  • contao/core-bundle, Packagist4.12.3OSV
  • contao/core-bundle, Packagist4.12.4OSV
  • contao/core-bundle, Packagist4.12.5OSV
  • contao/core-bundle, Packagist4.12.6OSV
  • contao/core-bundle, Packagist4.12.7OSV
  • contao/core-bundle, Packagist4.13.0OSV
  • contao/core-bundle, Packagist4.13.0-RC1OSV
  • contao/core-bundle, Packagist4.13.0-RC2OSV
  • contao/core-bundle, Packagist4.13.0-RC3OSV
  • contao/core-bundle, Packagistfrom 5.4.0-RC1, fixed in 5.7.12OSV
  • contao/core-bundle, Packagist5.4.0OSV
  • contao/core-bundle, Packagist5.4.0-RC1OSV
  • contao/core-bundle, Packagist5.4.0-RC2OSV
  • contao/core-bundle, Packagist5.4.0-RC3OSV
  • contao/core-bundle, Packagist5.4.0-RC4OSV
  • contao/core-bundle, Packagist5.4.1OSV
  • contao/core-bundle, Packagist5.4.10OSV
  • contao/core-bundle, Packagist5.4.11OSV
  • contao/core-bundle, Packagist5.4.12OSV
  • contao/core-bundle, Packagist5.4.13OSV
  • contao/core-bundle, Packagist5.4.14OSV
  • contao/core-bundle, Packagist5.4.2OSV
  • contao/core-bundle, Packagist5.4.3OSV
  • contao/core-bundle, Packagist5.4.4OSV
  • contao/core-bundle, Packagist5.4.5OSV
  • contao/core-bundle, Packagist5.4.6OSV
  • contao/core-bundle, Packagist5.4.7OSV
  • contao/core-bundle, Packagist5.4.8OSV
  • contao/core-bundle, Packagist5.4.9OSV
  • contao/core-bundle, Packagist5.5.0OSV
  • contao/core-bundle, Packagist5.5.0-RC1OSV
  • contao/core-bundle, Packagist5.5.0-RC2OSV
  • contao/core-bundle, Packagist5.5.0-RC3OSV
  • contao/core-bundle, Packagist5.5.0-RC4OSV
  • contao/core-bundle, Packagist5.5.1OSV
  • contao/core-bundle, Packagist5.5.10OSV
  • contao/core-bundle, Packagist5.5.11OSV
  • contao/core-bundle, Packagist5.5.12OSV
  • contao/core-bundle, Packagist5.5.13OSV
  • contao/core-bundle, Packagist5.5.14OSV
  • contao/core-bundle, Packagist5.5.15OSV
  • contao/core-bundle, Packagist5.5.16OSV
  • contao/core-bundle, Packagist5.5.2OSV
  • contao/core-bundle, Packagist5.5.3OSV
  • contao/core-bundle, Packagist5.5.4OSV
  • contao/core-bundle, Packagist5.5.5OSV
  • contao/core-bundle, Packagist5.5.6OSV
  • contao/core-bundle, Packagist5.5.7OSV
  • contao/core-bundle, Packagist5.5.8OSV
  • contao/core-bundle, Packagist5.5.9OSV
  • contao/core-bundle, Packagist5.6.0OSV
  • contao/core-bundle, Packagist5.6.0-RC1OSV
  • contao/core-bundle, Packagist5.6.0-RC2OSV
  • contao/core-bundle, Packagist5.6.0-RC3OSV
  • contao/core-bundle, Packagist5.6.1OSV
  • contao/core-bundle, Packagist5.6.10OSV
  • contao/core-bundle, Packagist5.6.11OSV
  • contao/core-bundle, Packagist5.6.2OSV
  • contao/core-bundle, Packagist5.6.3OSV
  • contao/core-bundle, Packagist5.6.4OSV

References 5