CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

• CWE-524
• CWE-863

• https://github.com/contao/contao/commit/9d6f582a4cc6a758ce11d1043fc9c0ba62c5f4c9
• https://github.com/contao/contao/releases/tag/5.7.12
• https://github.com/contao/contao/security/advisories/GHSA-5974-gfqc-wrcm

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107842Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…5.3
• CVE-2026-107843Contao is an Open Source CMS. From version 4.1.0 until 5.3.5…5.3
• CVE-2026-107844Contao is an Open Source CMS. From version 5.0.0 until 5.3.5…5.3
• CVE-2026-107845Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…9.3
• CVE-2026-107848Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…3.5
• CVE-2026-107850Contao is an Open Source CMS. From version 5.7.1 until 5.7.1…4.3
• CVE-2026-107852Jexactyl is a customisable game management panel and billing…7.1
• CVE-2026-107854Jexactyl is a customisable game management panel and billing…5.4
• CVE-2026-107856CiviForm simplifies applications for government benefits pro…4.5
• CVE-2026-107857Mindwtr is a free offline-first task management application …4.4
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3