CVE-2026-107851 in Contao
Summary
by MITRE • 10/10/2026
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within Contao versions 5.7.0 through 5.7.12 represents a critical flaw in the application's access control logic, specifically residing in the TableAccessVoter component of the core-bundle security module. This issue stems from an improper caching mechanism that fails to account for all relevant contextual variables when determining user permissions. In modern web applications, particularly content management systems with complex role-based access controls, accurate authorization decisions are paramount to maintaining data integrity and confidentiality. The specific function TableAccessVoter::hasAccessToModule() is responsible for evaluating whether a given security token grants the user permission to interact with a particular database table or module within the backend interface. However, the implementation of its caching strategy was fundamentally flawed because it relied exclusively on $tokenHash, which serves as a unique identifier derived from the user's current security session and authentication state. By omitting the specific data source context returned by getDataSource(), the voter failed to distinguish between different tables that might have distinct permission profiles for the same user.
This architectural oversight leads directly to an authorization bypass scenario where cached decisions are incorrectly reused across disparate contexts. When a low-privileged backend user initiates requests, the system processes them through this flawed voting mechanism. If the first request checks access against a table or module to which the user is legitimately granted permission, the voter caches the positive result based solely on the token hash. Subsequently, if another request from the same session attempts to access a different table that should be denied due to insufficient privileges, the system retrieves the cached entry associated with that token hash without verifying whether it applies to the new target resource. Consequently, the authorization check returns an affirmative decision for the restricted table, effectively bypassing the intended security restrictions. This behavior is exacerbated by the interaction between TableAccessVoter and DefaultDataContainerVoter, where a default voter might convert what should be an abstention or denial into a grant if it receives conflicting signals from other voters in the chain.
The operational impact of this vulnerability is severe, as it allows attackers with low-privileged accounts to escalate their access rights significantly. An attacker can read sensitive data stored in tables that are normally restricted to administrators or specific roles, such as member personal information and newsletter subscriber details. Beyond mere data exfiltration, the flaw permits unauthorized creation, update, and deletion of records within these protected areas. This level of control undermines the principle of least privilege and compromises the confidentiality, integrity, and availability of the application's data. For organizations relying on Contao for managing user communities or marketing campaigns, this could result in significant regulatory compliance issues under frameworks like GDPR due to the exposure of personally identifiable information. The ability to modify or delete records further threatens the operational stability of the CMS, potentially leading to service disruption or corruption of critical business logic dependent on accurate data states.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration, as it involves improper enforcement of access restrictions based on session context. In terms of the MITRE ATT&CK framework, this behavior is indicative of Tactic TA0005 Defense Evasion, specifically leveraging techniques related to privilege escalation or bypassing user control mechanisms such as Access Control Lists. The exploitation path resembles aspects of T1078 Valid Accounts, where an attacker uses legitimate credentials but exploits a logic flaw to gain unauthorized access to restricted resources. To mitigate this risk, organizations must ensure that all Contao instances are upgraded to version 5.7.12 or later, which corrects the caching logic by incorporating the data source context into the cache key calculation. This ensures that authorization decisions remain isolated per resource and cannot be erroneously shared across different tables with differing permission requirements. Additionally, implementing strict input validation and monitoring for unusual access patterns to sensitive backend modules can provide an additional layer of defense against exploitation attempts while patching is being applied.