Contao CMS EUVD-2026-95961

Exploitation requires that the site administrator had contao.search.index_protected ENABLED (so protected pages were written into tl_search with per-row authorization metadata) and then changed it to DISABLED, which drops the protected-row filter in ModuleSearch without purging the previously indexed rows. The attacker then simply uses the front-end ModuleSearch module (no authentication, no user interaction). Limiting factors: this is NOT a default-configuration flaw - it depends on that specific configuration transition and on protected content having been indexed beforehand; sites that never enabled protected indexing, or that never disabled it, or that reindexed after the change, are not affected. Impact is limited to disclosure of page titles, URLs, and indexed text snippets - the protected pages themselves still enforce authorization and are not accessible.

This is a moderate-severity information-disclosure issue (CWE-200) whose real-world risk is genuinely low despite being network-reachable and unauthenticated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) reflects remote unauthenticated reach with only low confidentiality impact and no integrity or availability impact, and no scope change. Critically, exploitation is gated on a specific operator action: contao.search.index_protected must have been changed from enabled to disabled while protected pages were already indexed in tl_search - a non-default configuration transition the attacker cannot cause themselves, which the scored AC:L arguably understates. No EPSS score, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor advisory (GHSA-x2rp-9qf7-2fmq) and the linked commit confirm the root cause and fix, so the technical facts are well-substantiated, but the impact is bounded - the description explicitly states this exposes search metadata and indexed text, NOT page-access bypass, since protected pages still return an authorization response. Net: a legitimate but low-priority patching item, not an emergency; prioritize sites that have actually toggled index_protected off.

An unauthenticated visitor to a Contao site uses the front-end ModuleSearch form on an installation where the administrator previously indexed protected pages and later set contao.search.index_protected to disabled. The search results return titles, URLs, and context snippets from protected pages that remain in tl_search, leaking restricted content metadata without any authentication or user interaction. No public exploit code is identified at time of analysis, though the attack requires only ordinary search queries once the vulnerable configuration state exists.