CVE-2026-107850

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.1 through 5.7.11

Description In the core-bundle/config/services.yaml file, the preview access voter is registered as ContaoCoreBundleSecurityVoterDataContainerPreviewAccessVoter, while the actual class provided is PreviewVoter. This mismatch causes Symfony to omit voter autoconfiguration and remove the private service during container compilation. Consequently, the ownership check in the PreviewVoter::hasAccess() function is never executed. A non-administrator backend user with access to the preview link module can list all tl preview link records and obtain signed share URLs created by other users. These URLs allow the user to view unpublished pages via showUnpublished without requiring the necessary page permissions.

Recommendations Update to version 5.7.12.