CVE-2026-107842

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 5.3.49 Contao versions 5.7.0 through 5.7.11

Description In the ModuleSearch module, protected page titles, URLs, and indexed context snippets may be disclosed to unauthenticated visitors. This occurs when the contao.search.index protected setting is changed from enabled to disabled. Because authorization metadata is stored per row in the tl search table, disabling the setting removes the protected-row filter without deleting the rows that were indexed while protection was active. While the actual pages still return an authorization response (401), the search metadata and indexed text remain exposed.

Recommendations Update Contao to version 5.3.50. Update Contao to version 5.7.12.