Contao CMS CVE-2026-107851

Exploitation requires an authenticated backend user who holds at least one valid module/table permission (a low-privileged, non-admin account is sufficient - PR:L), so this is NOT remote-unauthenticated. The specific triggering condition is request-ordering within a single HTTP request: an authorization check for a table the user IS allowed to access must occur before a check for a table the user is NOT allowed to access, because the TableAccessVoter caches the first decision under a key built only from the token hash and omits the table name, causing DefaultDataContainerVoter to convert an abstention into a grant. Limiting factors: valid backend credentials are mandatory; the flaw only affects Contao 5.7.0 through 5.7.11 (fixed in 5.7.12); and it is confined to backend DCA table operations, with the highest-value targets being personal-data tables such as member and newsletter-subscriber records.

This is a genuine but moderate-severity access-control flaw, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) confirms network reachability but requires PR:L - an authenticated, low-privileged backend user - which sharply limits the attacker population to insiders or anyone who has already obtained valid (even minimal) backend credentials. No EPSS score, SSVC decision data, or KEV listing was supplied in the input, so exploitation probability cannot be quantified; exploitation status is 'no public exploit identified at time of analysis' (the only code reference is the vendor patch commit, which is a fix, not an exploit). One notable internal conflict: the published CVSS scores only Confidentiality (C:L/I:N/A:N), yet the advisory and description explicitly state the flaw permits create, update, and delete operations on out-of-scope tables - that is a clear integrity (and arguably availability) impact that the vendor vector understates. Treat this as a legitimate privilege-escalation/horizontal-access issue affecting GDPR-relevant data (member and newsletter-subscriber records), prioritized for environments with multiple backend users, but de-prioritized relative to unauthenticated RCE given the authentication barrier and the request-ordering precondition.

A low-privileged Contao backend user who legitimately has access to one module (e.g. News) crafts or triggers a backend request that first exercises an access check against a table they are allowed to use and then targets a table they are not permitted to use (e.g. tl_member or tl_newsletter_recipients) within the same request lifecycle. Because the voter cached the first 'allowed' decision under a key omitting the table name, the denied table reuses the grant, letting the user read, create, update, or delete member and newsletter-subscriber data outside their module permissions. No public exploit code was identified at time of analysis, though the one-line caching defect is clearly documented in the patch.