CVE-2026-107842

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107842

The Contao Open Source CMS (versions 4.0.0 through 5.3.50 and 5.7.12) contains a vulnerability in ModuleSearch where protected page titles, URLs, and context snippets are disclosed to unauthenticated visitors. This occurs when the contao.search.index_protected setting is changed from enabled to d...