Is CVE-2026-107850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107850 being exploited in the wild.

How severe is CVE-2026-107850?

Medium severity, with a CVSS score of 4.3, published 9 October 2026.

Which products and versions are affected?

Contao ; contao/core-bundle (Packagist) >= 5.7.1, < 5.7.12, ECOSYSTEM:introduced=5.7.1,fixed=5.7.12.

Is there a fix for CVE-2026-107850?

Yes. contao/core-bundle (Packagist): upgrade to 5.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107850 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107850?

Check whether you run Contao or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107850: Contao improper access control in preview links module

Q: Is there a fix for CVE-2026-107850?

Yes. contao/core-bundle (Packagist): upgrade to 5.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107850 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107850?

Check whether you run Contao or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107850 · Severity: medium · CVSS 4.3 · Published 2026-10-09

Contao is a web content management system that manages website pages and content publishing. A configuration error causes the preview link access control to be silently disabled, allowing any back-end user with preview link module access to view all preview URLs on the site—including those created by administrators—and share unpublished or restricted content with anyone via the signed preview links.

Technologies: Contao, contao/core-bundle (Packagist). Vendors: Contao, Packagist.

Quick answers

Is CVE-2026-107850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107850 being exploited in the wild.
How severe is CVE-2026-107850?: Medium severity, with a CVSS score of 4.3, published 9 October 2026.
Which products and versions are affected?: Contao <UNKNOWN>; contao/core-bundle (Packagist) >= 5.7.1, < 5.7.12, ECOSYSTEM:introduced=5.7.1,fixed=5.7.12.
Is there a fix for CVE-2026-107850?: Yes. contao/core-bundle (Packagist): upgrade to 5.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107850 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107850?: Check whether you run Contao or contao/core-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

contao/core-bundle (Packagist): upgrade to 5.7.12 or later
```
composer require contao/core-bundle:^5.7.12
```

Technical details

A mismatch between the registered service class name and the actual shipped class name causes Symfony's autoconfiguration to fail silently, leaving the PreviewVoter untagged and removed during container compilation. The tl_preview_link table lacks SQL-level ownership filters, allowing non-administrator users with module permission to enumerate all preview links and extract signed URLs. These URLs grant front-end preview of unpublished content without page permission checks, exposing restricted content to unauthorized users.

Affected products

Contao Contao <UNKNOWN>

Identifiers

CVE-2026-107850
GHSA-q6wp-fr43-gm9v

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.