Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M

CVE-2026-107850Contao: Improper access control in the preview links module

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	contao/core-bundle	5.7.12	GHSA-q6wp-fr43-gm9v

Affected products (as reported)

Vendor	Product	Versions
contao	contao	>= 5.7.1, < 5.7.12

Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/contao/contao/security/advisories/GHSA-q6wp-fr43-gm9v x_refsource_CONFIRM
https://github.com/contao/contao/commit/6b483d380a4b2dc61432c4c697e411508f93bf91 x_refsource_MISC
https://github.com/contao/contao/releases/tag/5.7.12 x_refsource_MISC