Contao: improper access control in TableAccessVoter (CVE-2026-107851)

What happened

TableAccessVoter::hasAccessToModule() cached authorization decisions using only a token hash ($tokenHash) and omitted the table returned by getDataSource(). If a request first evaluated a permitted table and then a different denied table, the voter could reuse the permitted result; DefaultDataContainerVoter could then convert an incorrect abstention into a grant. The flaw allows a low-privileged backend user to read, create, update, or delete records in tables outside assigned module permissions, including tables holding member or newsletter-subscriber data.

Technical cause

The voter cached decisions keyed only by a hash of the user's security token and did not include the data-source table in the cache key. This allowed a cached 'allowed' decision from one table check to be reused for a different table check within the same request, producing incorrect authorization results.

Why it matters

A low-privileged backend user can gain access to records outside their module permissions. The advisory explicitly cites the ability to read, create, update, or delete records in tables the user should not access, with examples including member and newsletter-subscriber data.

Who is affected

The issue affects contao/core-bundle releases from 5.7.0 up to (but not including) 5.7.12. Users running those releases in backend environments may be exposed.

Affected versions

Introduced in 5.7.0 and fixed in 5.7.12; versions prior to 5.7.12 but at or after 5.7.0 are affected.

Fixes and mitigation

A vendor fix is available. The advisory lists 5.7.12 as the fixed release. The sources do not document alternative workarounds in place of the update.

Recommended action

Upgrade contao/core-bundle to the fixed release 5.7.12 as provided by the vendor. If you cannot apply the update immediately, restrict backend user privileges where possible and monitor access to sensitive tables until you can patch.

Discovery and timeline

The advisory entries and database records for this issue were published on 2026-10-09. Refer to the OSV, GitHub Advisory Database, Packagist advisory, and NVD entries for source timestamps and details.