CVE-2026-107850

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/contao/contao/commit/6b483d380a4b2dc61432c4c697e411508f93bf91
https://github.com/contao/contao/releases/tag/5.7.12
https://github.com/contao/contao/security/advisories/GHSA-q6wp-fr43-gm9v

Configurations

No configuration.

History

09 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 21:17

Updated : 2026-10-16 17:17

NVD link : CVE-2026-107850

Mitre link : CVE-2026-107850

CVE.ORG link : CVE-2026-107850

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-107850", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107850", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T20:13:32.358417Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "contao", "product": "contao", "versions": [{"status": "affected", "version": ">= 5.7.1, < 5.7.12"}]}]}], "published": "2026-10-09T21:17:02.770", "references": [{"url": "https://github.com/contao/contao/commit/6b483d380a4b2dc61432c4c697e411508f93bf91", "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/releases/tag/5.7.12", "source": "security-advisories@github.com"}, {"url": "https://github.com/contao/contao/security/advisories/GHSA-q6wp-fr43-gm9v", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\\CoreBundle\\Security\\Voter\\DataContainer\\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12."}], "lastModified": "2026-10-16T17:17:04.113", "sourceIdentifier": "security-advisories@github.com"}