CVE-2026-107842

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107842
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107842.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107842
Aliases
Published
2026-10-09T19:02:30Z
Modified
2026-10-10T10:45:14Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Details

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107842.json"
}
References

Affected packages

Git / github.com/contao/contao

Affected ranges

Type
GIT
Repo
https://github.com/contao/contao
Events
Introduced
84b2fe637d5ead531f117f26b48d1b9de8df4074
Fixed
a11109b60dedcbd99e32a4e8550afdadb500f2c5
Introduced
c5e3841e5107ab36ae2bf7795fb8d51d3d30f88b
Fixed
a6543f49a92187a7368f51b290179c4795386e23
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "5.3.50"
        },
        {
            "introduced": "5.4.0-RC1"
        },
        {
            "fixed": "5.7.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107842.json"