Read the docs
TI-2026-70287 Aliases CVE-2026-107851GHSA-5974-gfqc-wrcm

Contao table access voter reuses cached decisions across tables

Priority LOW 19CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Contao versions from 5.7.0 before 5.7.12 are affected. The table access voter caches authorization decisions using only the user's token hash, so it can reuse an allowed result for a different, denied table (CWE-524). A low-privileged backend user can read, create, update or delete records in tables outside their assigned module permissions, including member and newsletter subscriber data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed contao (contao): 5.7.12contao/core-bundle (Packagist): 5.7.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
contaocontao5.7.0 to before 5.7.125.7.12Patch availableCNA
—contao/core-bundle (Packagist)5.7.0 to before 5.7.125.7.12Patch availableGHSA-5974-gfqc-wrcm
  • contao Vendorcontao Affected 5.7.0 to before 5.7.12 Fixed in 5.7.12 Patch available CNA
  • contao/core-bundle (Packagist) Vendor— Affected 5.7.0 to before 5.7.12 Fixed in 5.7.12 Patch available GHSA-5974-gfqc-wrcm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*——contao
  • cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* Versions — — ·contao

Remediation

Update contao/core-bundle to version 5.7.12. The sources list no fixed version for contao.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA contao (contao) Fixed in 5.7.12
  • Fix · GHSA-5974-gfqc-wrcm contao/core-bundle (Packagist) Fixed in 5.7.12 Advisory →

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107851
  2. 2026-10-10 Alias added: GHSA-5974-gfqc-wrcm
  3. 2026-10-10 Fix available: Packagist/contao/[email protected] · GHSA-5974-gfqc-wrcm
  4. 2026-10-10 CVSS score added · GHSA-5974-gfqc-wrcm
  5. 2026-10-10 Weakness changed · GHSA-5974-gfqc-wrcm
  6. 2026-10-10 4 new references · GHSA-5974-gfqc-wrcm
  7. 2026-10-13 CISA SSVC decision points changed

References

Other 4

  • TI-2022-09661 Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)… CVSS 3.1CRITICAL 9.8
  • TI-2024-30849 Unrestricted file upload in Contao CVSS 3.1MEDIUM 6.4
  • TI-2023-18600 Contao cross site scripting vulnerability via input unit widget CVSS 3.1MEDIUM 6.5
  • TI-2014-01453 Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2022-08709 Cross site scripting via canonical tag CVSS 3.1HIGH 7.2
  • TI-2019-08602 Contao 4.x allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences