CVE-2026-107850 in Contao
Summary
by MITRE • 10/09/2026
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Contao versions 5.7.1 through 5.7.12 stems from a critical misconfiguration in the Symfony service container, specifically regarding the registration and auto-configuration of security voters. In these affected versions, the core-bundle/config/services.yaml file incorrectly registers the preview access voter under the class name Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, whereas the actual shipped implementation is located at PreviewVoter. This discrepancy triggers a failure in Symfony’s automatic service configuration mechanism. Because the registered class does not match the implemented class, Symfony omits the necessary autoconfiguration steps and subsequently removes or disables the private service responsible for enforcing access controls. Consequently, the logic within PreviewVoter::hasAccess(), which is designed to validate user permissions against specific data container records, never executes as intended during request processing. This architectural flaw effectively neutralizes a key security boundary that relies on voter-based authorization checks in Symfony applications.
The operational impact of this misconfiguration allows for significant unauthorized access to unpublished content and sensitive link metadata. A non-administrator backend user who possesses the preview_link module permission can exploit this flaw by listing all tl_preview_link records, regardless of ownership. Since the PreviewVoter logic is bypassed due to the service removal, there are no checks preventing a user from accessing data belonging to other users. The attacker can retrieve signed share URLs that were generated by other administrators or content editors for their own unpublished pages. By utilizing these stolen URLs, an attacker can view sensitive, unpublished web pages using the showUnpublished functionality without holding any specific page permissions themselves. This represents a severe breach of confidentiality and data isolation principles within the CMS environment.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically involving insufficient authorization checks for critical functions. The ability to list foreign records corresponds to CWE-601, URL Redirection to Untrusted Site in the Context of Open Redirect, although here it is used more broadly for unauthorized data access rather than just redirection. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1530, Data from Cloud Storage Object Dumps, as the attacker enumerates and retrieves stored objects (preview links) they do not own. It also relates to T1078, Valid Accounts, because the exploitation relies on legitimate but low-privilege credentials being used to access resources beyond their intended scope due to a system-level configuration error rather than credential compromise.
The resolution for this issue was implemented in Contao version 5.7.12 by correcting the service registration definition in the core-bundle/config/services.yaml file. The fix ensures that the correct class, PreviewVoter, is registered and properly autoconfigured within the Symfony container. This restores the execution of access control voters, thereby re-enforcing ownership checks on preview links and preventing non-owners from accessing or listing foreign records. Administrators running affected versions must upgrade to 5.7.12 or later immediately to restore these security controls. Until the upgrade is performed, organizations should monitor for unusual enumeration activity related to preview link modules by low-privilege users and consider restricting access to the preview_link module if feasible as a temporary mitigation measure.