---
cve: "CVE-2026-107842"
severity: "MEDIUM"
cvss: 5.3
epss: "0.3%"
vendor: "contao"
kev: false
exploited: false
published: "2026-10-09 20:17:10"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-26T11:35:24+01:00"
---

# CVE-2026-107842

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-13 20:26:18
- CNA-CVSS: **5.3** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-200** — Exposure of Sensitive Information to an Unauthorized Actor
  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

## Angriffsmuster (CAPEC)

- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-116 — Excavation](https://capec.mitre.org/data/definitions/116.html) _(Severity: Medium)_
- [CAPEC-169 — Footprinting](https://capec.mitre.org/data/definitions/169.html) _(Severity: Very Low)_
- [CAPEC-224 — Fingerprinting](https://capec.mitre.org/data/definitions/224.html) _(Severity: Very Low)_
- [CAPEC-285 — ICMP Echo Request Ping](https://capec.mitre.org/data/definitions/285.html) _(Severity: Low)_
- [CAPEC-287 — TCP SYN Scan](https://capec.mitre.org/data/definitions/287.html) _(Severity: Low)_
- [CAPEC-290 — Enumerate Mail Exchange (MX) Records](https://capec.mitre.org/data/definitions/290.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1217 — Browser Bookmark Discovery](https://attack.mitre.org/techniques/T1217/)
- [T1592 — Gather Victim Host Information](https://attack.mitre.org/techniques/T1592/)
- [T1595 — Active Scanning](https://attack.mitre.org/techniques/T1595/)

## Patch verfügbar (OSV)

- a11109b60dedcbd99e32a4e8550afdadb500f2c5 (Commit)
- a6543f49a92187a7368f51b290179c4795386e23 (Commit)

## BSI-Hinweise (deutsch)

- [Contao: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2999) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern und möglicherweise Administratorrechte zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, sensible Informationen offenzulegen und Daten zu manipulieren.

## Referenzen

- <https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq>
- <https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457>
- <https://github.com/contao/contao/releases/tag/5.3.50>
- <https://github.com/contao/contao/releases/tag/5.7.12>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-107842/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_