Vulnerability in contao/core-bundle (CVE-2026-107851)
Summary
Vulnerability in contao/core-bundle (CVE-2026-107851). Risk of unauthorized operations or information disclosure. Exploitable via TableAccessVoter. Mitigation: upgrade to 5.7.12 or later.
Original description
The description as published by the source.
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses.
Vulnerability Details
In plain terms: Contao's backend is organized into modules (e.g. "News", "Members"). Every backend user is assigned to a group, and that group decides which modules, and therefore which database tables, they are allowed to work with. Before Contao lets a user touch a table, it is supposed to check: "does this user's group actually include this table?"
To avoid doing that check over and over, Contao remembers the answer for the rest of the request. The problem is that it remembers the answer under the wrong label. Instead of remembering "is this user allowed to access table X", it only remembers "is this user allowed to access something", without recording which table the answer was actually about.
So if a request first checks a table the user IS allowed to see, and then checks a second, completely different table the user is NOT allowed to see, Contao reuses the first answer for the second table too. The user ends up with access to a table their group was never given permission for.
Technical detail
Contao's backend enforces…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-107851 has been found in contao/core-bundle.
Attackers can target a specific entry point like TableAccessVoter over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.3/10.
What to do: upgrade contao/core-bundle to 5.7.12 or later.
If unsure, ask your IT team or search "contao/core-bundle CVE-2026-107851" on the vendor's site.
CVE-2026-107851 (contao/core-bundle) — CWE-524 / CVSS v3 4.3
Attack vector: remote (network-reachable) / no user interaction
Attack surface: TableAccessVoter / DefaultDataContainerVoter / tl_content / tl_favorites
Patched: 5.7.12 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-524) exists in contao/core-bundle. Attackers reach the vulnerable code path via TableAccessVoter.
Check the vendor advisory for the affected versions of contao/core-bundle. Attack surface: TableAccessVoter / DefaultDataContainerVoter / tl_content / tl_favorites.
Severity: Medium (CVSS 4.3/10). Risk of unauthorized operations or information disclosure.
Update to 5.7.12.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'contao/core-bundle' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'contao/core-bundle' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
contao/core-bundleを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade contao/core-bundle to 5.7.12ステージング環境で 5.7.12 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。