CVE-2026-107851

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.0 through 5.7.11

Description A caching defect in the security voter governing table-level access to the Data Container (DCA) backend allows a low-privileged, non-admin backend user to obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes sensitive personal data such as frontend member records and newsletter subscriber email addresses.

The issue occurs in the TableAccessVoter::hasAccessToModule() function within core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The function caches authorization decisions using only the $tokenHash variable, which is a hash of the user's security token, but fails to include the table returned by getDataSource(). Consequently, if a request first checks a table the user is permitted to access and subsequently checks a denied table, the voter reuses the initial allowed result. This is further exacerbated by the DefaultDataContainerVoter, which can convert an incorrect abstention into a grant.

Recommendations Update to version 5.7.12.