Contao CMS CVE-2026-107850

Requires an authenticated non-administrator Contao backend user whose user group is assigned the preview_link module; affected versions are 5.7.1 through 5.7.11. Given those prerequisites, exploitation is deterministic in default configurations because the mis-registered voter is silently dropped at container compile time and tl_preview_link has no createdBy SQL filter - no special setting must be toggled on. The limiting factors are the backend-account requirement and the preview_link module grant: installations with only administrator backend users, or that never assign the preview_link module to non-admin groups, are not exposed. Impact is confined to reading preview links and viewing unpublished pages; modifying or deleting other users' links is blocked by DcaPermissionVoter.

This is a genuine but moderate-priority issue, correctly rated low-to-medium rather than critical. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) is internally consistent with the description: network-reachable backend, low complexity, and crucially PR:L - the attacker must already hold an authenticated non-admin backend account whose group includes the preview_link module. This privilege prerequisite is the single largest limiter and keeps real-world risk contained to environments that provision multiple backend users with that module. Impact is confidentiality-only (C:L) and bounded: the advisory explicitly states (and verified in the reporter's lab via DcaPermissionVoter) that editing or deleting foreign preview links is NOT possible, so I:N/A:N are appropriate. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so exploitation-probability and automatability signals cannot be weighed - absence of these is not evidence of low interest, but there is also no evidence of active exploitation. The root cause is unusually reliable once prerequisites are met: a class-name typo in services.yaml (PreviewAccessVoter vs shipped PreviewVoter) causes Symfony to silently drop the voter, so the ownership check never runs and there is no compensating SQL createdBy filter. Net: a real, deterministic authorization-bypass worth patching, but gated behind an authenticated multi-user backend configuration, which keeps it well below critical.

A disgruntled or compromised low-privilege Contao editor whose group was granted the preview_link module opens the preview links list in the backend and sees every preview link on the installation, including those created by administrators. They copy an already-signed share URL for an embargoed page and open it (or forward it), viewing the unpublished content via showUnpublished despite having no permission on that page. No public exploit code was identified at time of analysis; exploitation requires only ordinary backend interaction and no special tooling.