CVE-2026-107842

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

• CWE-200

• https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457
• https://github.com/contao/contao/releases/tag/5.3.50
• https://github.com/contao/contao/releases/tag/5.7.12
• https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107836RIOT is an open-source microcontroller operating system desi…7.1
• CVE-2026-107837RIOT is an open-source microcontroller operating system desi…8.2
• CVE-2026-107838RIOT is an open-source microcontroller operating system desi…7.5
• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7
• CVE-2026-107843Contao is an Open Source CMS. From version 4.1.0 until 5.3.5…5.3
• CVE-2026-107844Contao is an Open Source CMS. From version 5.0.0 until 5.3.5…5.3
• CVE-2026-107845Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…9.3
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
• CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…3.3