Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107851: Contao core bundle lets low‑privilege admin access restricted tables

CVE-2026-107851 · published 26 days ago

Summary

Versions 5.7.0 through 5.7.11 of the Contao core bundle allow a backend user with limited rights to see and change data in areas they shouldn't. The problem occurs because the system re‑uses a previous permission check and forgets which table was being checked. Update to version 5.7.12 or later to fix the issue.

What to do

Update contao core-bundle to version 5.7.12.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	contao	core-bundle	>= 5.7.0, < 5.7.12 Fix: upgrade to 5.7.12

Original advisory text

Contao: Improper access control in the table access voter

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

References

https://github.com/advisories/GHSA-5974-gfqc-wrcm
https://github.com/contao/contao/releases/tag/5.7.12 URL
https://github.com/contao/contao/commit/9d6f582a4cc6a758ce11d1043fc9c0ba62c5f4c9 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1078... Vendor Advisory
https://github.com/contao/contao/security/advisories/GHSA-5974-gfqc-wrcm Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107851 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-524Use of Cache Containing Sensitive Information

CWE-863Incorrect Authorization

Timeline

Published9 Oct 2026

Updated4 Nov 2026

First seen9 Oct 2026

Sources

CVE-2026-107851 · NVD

GHSA-5974-gfqc-wrcm · GHSA

CVE-2026-107851 · OSV

Track software like this

Free during beta