CVE-2026-107851: 
PHP vulnerability analysis and mitigation

CVE-2026-107851 is an improper access control vulnerability in Contao CMS, an open-source PHP content management system, caused by a caching defect in the TableAccessVoter security voter. It affects Contao versions 5.7.0 through 5.7.11 (patched in 5.7.12) and allows a low-privileged, authenticated backend user to read, create, update, or delete records in database tables outside their assigned module permissions. The vulnerability was discovered by Sven Jäger of SySS GmbH, published to the GitHub Advisory Database on October 9, 2026, and carries a CVSS v3.1 base score of 4.3 (Moderate) (Github Advisory, Contao Advisory).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information) and CWE-863 (Incorrect Authorization). In TableAccessVoter::hasAccessToModule() within core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php, the per-request authorization cache is keyed solely on $tokenHash — a hash of the user's security token — without incorporating the target table name returned by getDataSource(). As a result, if a single HTTP request first evaluates access to a permitted table (caching an "allowed" result), any subsequent check for a different, restricted table within the same request reuses that cached grant. This is compounded by DefaultDataContainerVoter, a low-priority permissive fallback voter that converts an abstention from TableAccessVoter into a full access grant for tables lacking a secondary, table-specific voter (e.g., tl_member, tl_newsletter_recipients, tl_news, tl_calendar_events). The fix, applied in commit 9d6f582, changes the cache key to $tokenHash . ' ' . $table, ensuring each table's authorization result is cached independently (Contao Advisory, Fix Commit).

A low-privileged, authenticated backend user can bypass module-level access controls to read, create, update, or delete records in database tables they were never granted permission to access. Sensitive data at risk includes frontend member records (tl_member), newsletter subscriber email addresses (tl_newsletter_recipients), news articles, calendar events, FAQs, and comments. While the CVSS score reflects only a confidentiality impact, the advisory explicitly notes that write operations (create, update, delete) are also possible, meaning data integrity is also at risk for affected tables (Github Advisory, Contao Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Github Advisory). Exploitation requires a valid, low-privileged backend account, limiting the attack surface to authenticated users. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

1. Obtain backend credentials: Acquire a low-privileged, non-admin Contao backend user account that has permission to access at least one module (e.g., "Newsletter").
2. Identify a permitted table: Determine which database table is associated with the permitted module (e.g., tl_newsletter for the Newsletter module).
3. Craft a request that triggers two table checks: Initiate a backend HTTP request that causes Contao to evaluate access for the permitted table first within the same request lifecycle, populating the voter's cache with an "allowed" result keyed only to the user's token hash.
4. Access a restricted table: Within the same request, trigger a check against a restricted table (e.g., tl_member for member data) — the voter returns the cached "allowed" result, and DefaultDataContainerVoter converts any abstention into a grant.
5. Perform unauthorized CRUD operations: Use the Contao backend DCA interface to read, create, update, or delete records in the unauthorized table (e.g., exfiltrate member email addresses from tl_member or tl_newsletter_recipients) (Contao Advisory).

• Logs: Contao backend access logs showing a low-privileged user accessing DCA endpoints for tables outside their assigned module permissions (e.g., contao?do=member, contao?do=newsletter_recipients) within the same session.
• Logs: Unexpected database query logs (if enabled) showing SELECT, INSERT, UPDATE, or DELETE operations on tl_member, tl_newsletter_recipients, tl_news, tl_calendar_events, tl_faq, or tl_comments by a user account not assigned to the corresponding module.
• Application Behavior: Backend user group configurations showing no assignment to a module (e.g., "Members") yet audit trails indicating that user accessed or modified records in the corresponding table.

The primary remediation is to upgrade Contao CMS to version 5.7.12 or later, which fixes the cache key logic in TableAccessVoter to include the table name alongside the token hash (Contao Release, Fix Commit). No configuration-based workaround is available since the flaw is in core authorization logic. As interim hardening measures, administrators should review and audit backend user group permissions to ensure the principle of least privilege is enforced, and monitor access logs for suspicious cross-table activity by low-privileged users (Github Advisory).

The vulnerability was responsibly disclosed by Sven Jäger of SySS GmbH and credited in the official Contao security advisory. The advisory was published by Contao maintainer leofeyer on August 25, 2026, and added to the GitHub Advisory Database on October 9, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Contao Advisory).