Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.indexprotected, but the authorisation data lives per row in tlsearch. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed...

CVE-2026-107842

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

EUVD-2026-95961

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107842

The Contao Open Source CMS (versions 4.0.0 through 5.3.50 and 5.7.12) contains a vulnerability in ModuleSearch where protected page titles, URLs, and context snippets are disclosed to unauthenticated visitors. This occurs when the contao.search.index_protected setting is changed from enabled to d...