Is CVE-2026-107842 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107842 being exploited in the wild.

How severe is CVE-2026-107842?

Medium severity, with a CVSS score of 5.3, published 9 October 2026.

Which products and versions are affected?

Contao Core Bundle >= 4.0.0, = 5.4.0-RC1, < 5.7.12; contao/core-bundle (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.3.50.

Is there a fix for CVE-2026-107842?

Yes. contao/core-bundle (Packagist): upgrade to 5.3.50 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107842 attacked?

It is attacked over the network.

Am I affected by CVE-2026-107842?

Check whether you run Contao Core Bundle or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107842: Contao protected page content disclosure via search index

Q: Is there a fix for CVE-2026-107842?

Yes. contao/core-bundle (Packagist): upgrade to 5.3.50 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107842 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-107842?

Check whether you run Contao Core Bundle or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107842 · Severity: medium · CVSS 5.3 · Published 2026-10-09

Contao is a content management system that allows websites to restrict access to member-only pages. When administrators disable the setting to index protected pages, the system fails to remove previously indexed member-only content from its search index, allowing anonymous visitors to see page titles, URLs, and excerpts through search results even though the pages themselves remain access-controlled. This does not grant actual access to the protected pages but exposes sensitive page information.

Technologies: Contao Core Bundle, contao/core-bundle (Packagist). Vendors: Contao, Packagist.

Quick answers

Is CVE-2026-107842 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107842 being exploited in the wild.
How severe is CVE-2026-107842?: Medium severity, with a CVSS score of 5.3, published 9 October 2026.
Which products and versions are affected?: Contao Core Bundle >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12; contao/core-bundle (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.3.50.
Is there a fix for CVE-2026-107842?: Yes. contao/core-bundle (Packagist): upgrade to 5.3.50 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107842 attacked?: It is attacked over the network.
Am I affected by CVE-2026-107842?: Check whether you run Contao Core Bundle or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

contao/core-bundle (Packagist): upgrade to 5.3.50 or later
```
composer require contao/core-bundle:^5.3.50
```

Technical details

ModuleSearch filters protected pages from search results based on the current value of contao.search.index_protected, but authorization metadata is stored per row in the tl_search table. Disabling index_protected removes the filter without purging previously indexed rows marked as protected, causing those protected pages to be disclosed to unauthenticated users via search. This is an information disclosure vulnerability with no integrity or availability impact.

Affected products

Contao Core Bundle >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12

Identifiers

CVE-2026-107842
GHSA-x2rp-9qf7-2fmq

Timeline

2026-08-25: disclosed
2026-10-09: advisory

References

https://api.github.com/users/iRevivalx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.