CVE-2026-107850: 
PHP vulnerability analysis and mitigation

CVE-2026-107850 is an improper access control vulnerability in the preview links module of Contao, an open-source CMS. It affects Contao contao/core-bundle versions >= 5.7.1 and < 5.7.12, and was originally published on August 25, 2026, with the advisory added to the GitHub Advisory Database on October 9, 2026. The flaw allows a low-privileged backend user to enumerate all preview links on the installation and access unpublished content without proper authorization. It carries a CVSS v3.1 base score of 4.3 (Medium) (Github Advisory, Contao Advisory).

The root cause is a service misconfiguration in core-bundle/config/services.yaml, which registers the preview access voter under the class name Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, while the actual class on disk is named PreviewVoter (CWE-862: Missing Authorization, CWE-639: Authorization Bypass Through User-Controlled Key). When Symfony attempts to resolve the class via getReflectionClass($class, false), it receives null, silently skips interface-based autoconfiguration that would have tagged the service as a voter, and removes the untagged private service during container compilation — all without emitting any warning. As a result, PreviewVoter::hasAccess() is never invoked, and the tl_preview_link table has no compensating SQL filter on the createdBy column, so any backend user with the preview_link module can read all preview link records and extract signed share URLs created by any user, including administrators (Github Advisory, Contao Advisory, Patch Commit).

A non-administrator backend user with access to the preview_link module can list every tl_preview_link record on the installation, including those created by administrators, and extract already-signed share URLs. Using these URLs, the attacker — or anyone they forward the URL to — can access unpublished or embargoed front-end pages with showUnpublished enabled and without any page permission checks. The impact is limited to confidentiality (unauthorized read access to unpublished content); the advisory confirms that editing or deleting foreign preview links is blocked by DcaPermissionVoter, so integrity and availability are not affected (Github Advisory, Contao Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated backend account with the preview_link module assigned, limiting the attacker pool to existing low-privileged users.

1. Gain backend access: Log in to the Contao backend as a non-administrator user whose group has the preview_link module enabled.
2. Navigate to preview links: Access the preview links list view in the backend (e.g., via the tl_preview_link data container). Due to the missing voter, all records — including those created by other users and administrators — are returned without ownership filtering.
3. Extract signed share URLs: From the list, copy the signed share URLs associated with preview links created by other users. These URLs are pre-signed and do not require further authentication.
4. Access unpublished content: Open the extracted signed URL in a browser (authenticated or not). The front-end preview loads the target page with showUnpublished active and bypasses all page permission checks, exposing unpublished or embargoed content.
5. Distribute the URL (optional): Forward the signed URL to third parties, who can also view the unpublished content without any Contao account (Github Advisory, Contao Advisory).

• Logs: Backend access logs showing a non-administrator user account repeatedly accessing the tl_preview_link list view, especially if the user has no legitimate reason to view all preview links.
• Logs: Front-end access logs showing requests to signed preview share URLs originating from IP addresses not associated with the backend user who created the link, or from unauthenticated sessions.
• Network: Unusual outbound sharing of Contao preview URLs (containing signed tokens) to external parties or unfamiliar IP ranges.
• Application: Audit of tl_preview_link records revealing that non-administrator users accessed or viewed records with a createdBy value belonging to other users or administrators.

Update Contao CMS to version 5.7.12, which corrects the service registration in core-bundle/config/services.yaml (renaming the service to contao.security.data_container.preview_voter with the correct class PreviewVoter) and adds a createdBy SQL filter in PreviewLinkListener.php for non-admin users (Patch Commit, Release 5.7.12). As a temporary workaround, restrict backend access to the preview_link module to trusted administrators only. Additionally, audit existing preview links for unauthorized access and consider invalidating sensitive preview links created before the patch is applied (Github Advisory).

The vulnerability was discovered and reported by HDWSec and published by Contao maintainer leofeyer (Contao Advisory). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time.