CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module

Contao is an open-source Content Management System (CMS) built on the Symfony PHP framework. The framework provides indexed full-text search capabilities through ModuleSearch and the underlying database table tl_search. When pages are indexed, metadata including protection status and permitted user groups are recorded alongside textual excerpts.

CVE-2026-107842 represents an information disclosure flaw (CWE-200) located within the ModuleSearch component. The flaw occurs when system administrators toggle the global parameter contao.search.index_protected from true to false. When disabled, the search execution engine stops filtering out previously indexed records that belong to protected pages.

While direct HTTP access control to protected target URLs remains enforced by Contao's access control layer, unauthenticated remote attackers can query the public search endpoint to expose protected page titles, canonical URLs, and indexed content snippets.

Contao's full-text search engine indexes web pages into the tl_search table. Each row in tl_search stores indexed body text alongside metadata columns, specifically protected (a boolean flag indicating if the page requires authentication) and groups (a serialized array of allowed member group IDs).

When contao.search.index_protected is set to true, Contao allows protected pages to be indexed. During search execution, ModuleSearch::compile() queries tl_search and executes an inline filtering callback. This callback evaluates whether the current user possesses authorization for each returned row via ContaoCorePermissions::MEMBER_IN_GROUPS checks.

Prior to the patch, the filtering callback was wrapped in an if condition checking whether contao.search.index_protected was active. If an administrator set contao.search.index_protected to false, no else block existed. Consequently, existing database records in tl_search marked with protected = true were returned directly to unauthenticated visitors without filtering.

The vulnerability was resolved in commit 572686a113bca60f92cf2d0496cf3a74d0b6b457 on August 25, 2026. The patch modifies core-bundle/contao/modules/ModuleSearch.php by introducing an explicit fallback filter when contao.search.index_protected evaluates to false.

// Prior to patch:
if (System::getContainer()->getParameter('contao.search.index_protected')) {
    $objResult->applyFilter(static function ($v) {
        return empty($v['protected']) || System::getContainer()->get('security.helper')->isGranted(ContaoCorePermissions::MEMBER_IN_GROUPS, StringUtil::deserialize($v['groups'] ?? null, true));
    });
}
 
// Patched logic in core-bundle/contao/modules/ModuleSearch.php:
if (System::getContainer()->getParameter('contao.search.index_protected')) {
    $objResult->applyFilter(static function ($v) {
        return empty($v['protected']) || System::getContainer()->get('security.helper')->isGranted(ContaoCorePermissions::MEMBER_IN_GROUPS, StringUtil::deserialize($v['groups'] ?? null, true));
    });
}
else
{
    $objResult->applyFilter(static function ($v) {
        return empty($v['protected']);
    });
}

The added else block enforces strict filtering on search results. When contao.search.index_protected is disabled, the system filters out any result where $v['protected'] is non-empty, preventing historical protected index records from leaking to unauthenticated clients.

Exploitation does not require authentication, specialized tools, or complex payload construction. An attacker submits standard search queries to the target Contao website's search form endpoint (typically /search or pages containing ModuleSearch).

If the website previously indexed protected pages while contao.search.index_protected was enabled, those entries persist in tl_search. Upon querying relevant terms, the search results page renders title links, full target URLs, and contextual excerpts of restricted pages.

The vulnerability is assigned a CVSS v3.1 base score of 5.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Direct exposure is limited to search metadata and indexed body text snippets rather than full underlying database records or administrative session access.

Impact severity depends on the nature of information contained within protected pages. If member-only areas contain sensitive technical documentation, draft publications, internal contact lists, or personal identifying information (PII), unauthenticated extraction via targeted search terms represents a partial confidentiality breach.

No integrity loss or system availability disruption occurs as a result of this flaw. Furthermore, direct requests to the exposed target page URLs remain blocked by Contao's page-level security controls.

Software updates have been issued in Contao maintenance releases 5.3.50 and 5.7.12. Administrators operating affected releases should update their dependencies using Composer.

composer update contao/contao --with-dependencies

For environments where immediate framework upgrades cannot be applied, administrators who disabled contao.search.index_protected must navigate to the Contao Maintenance backend panel and initiate a complete purge and rebuild of the search index. Rebuilding the search index purges existing entries in tl_search, eliminating stale protected index entries.