CVE-2026-107842: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.indexprotected, but the authorisation data lives per row in tlsearch. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed while it was on are returned to unauthenticated visitors such as title, URL and context snippet, even though the pages themselves still answer 401.
Impact
Disclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass.
Credits
This security vulnerability was found by @iRevivalx .
Other sources
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row in tlsearch, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.7.12 - Upgrade
Upgrade
composer/contao/core-bundleto a version that resolves this vulnerability.Fixed in 5.3.50 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.3.50 - Upgrade
Upgrade
Contaoto a version that resolves this vulnerability.Fixed in 5.7.12
Event History
Frequently Asked Questions
Which deployments are exposed to this disclosure?
Deployments are exposed when protected content was indexed while contao.search.index_protected was enabled, and the setting was later changed to disabled. Affected versions are from 4.0.0 through versions before 5.3.50 and 5.7.12.
What can an unauthenticated attacker obtain?
An unauthenticated visitor can obtain protected page titles, URLs, and indexed context snippets through ModuleSearch. The underlying protected pages still enforce authorization, so this does not bypass access controls for the pages themselves.
What configuration change triggers the issue?
The issue is triggered by changing contao.search.index_protected from enabled to disabled after protected rows have already been stored in tl_search. Disabling the setting removes the protected-row filter but does not delete rows that were indexed while protection was enabled.
How can an administrator determine whether their instance may be affected?
Review whether contao.search.index_protected was enabled when protected pages were indexed and was subsequently disabled. Also inspect unauthenticated ModuleSearch results for titles, URLs, or snippets from protected pages.
Which versions contain the fix?
The issue is fixed in Contao 5.3.50 and 5.7.12.