CVE-2026-107842

Executive Summary

CVE-2026-107842 is an information disclosure vulnerability in Contao, an open-source content management system. When the configuration setting contao.search.index_protected is changed from enabled to disabled, the ModuleSearch component discloses protected page titles, URLs, and indexed context snippets to unauthenticated visitors. Versions 4.0.0 through 5.3.49 and 5.4.0 through 5.7.11 are affected; the issue is fixed in 5.3.50 and 5.7.12. The impact is limited to exposure of search metadata and indexed text, not a bypass of page-level access controls.

Technical Analysis

The vulnerability resides in the Contao search subsystem, specifically the ModuleSearch front-end module. Contao's search functionality maintains an index in the tl_search database table. According to the NVD description, authorization metadata is stored per row in this table, meaning each indexed item carries the access-control context under which it was indexed.

The root cause is a state-dependent filter failure. When contao.search.index_protected is set to enabled, the search indexing process records protected pages and their authorization metadata alongside the indexed content. The search runtime query applies a filter that removes protected rows from the result set returned to unauthenticated visitors. However, when an administrator changes the setting from enabled to disabled, the protected-row filter is removed from the query logic, but the rows that were indexed while protection was enabled are not deleted. This leaves previously indexed protected content present in tl_search but no longer filtered out at query time.

As a result, unauthenticated visitors issuing search queries through ModuleSearch receive results that include protected page titles, their URLs, and indexed context snippets. Critically, the NVD description clarifies that the protected pages continue to return an authorization response — meaning direct access to those pages remains blocked. The exposure is confined to search metadata and indexed text fragments rather than the full page content or a genuine access-control bypass.

The weakness maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The security decision (whether to include protected rows in search results) is effectively decoupled from the data lifecycle: disabling the setting changes query behavior without remediating the residual indexed data. This is a classic case of authorization state being stored in one layer (per-row metadata in tl_search) while enforcement is applied in another layer (a runtime filter tied to a global setting), creating a latent disclosure window when the two diverge.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yields a base score of 5.3 (Medium). Network exploitability with no privileges or user interaction required reflects that any anonymous visitor can trigger the disclosure through normal search usage. The low confidentiality impact (C:L) reflects that only metadata and indexed snippets are exposed, not full protected content, and there is no integrity or availability impact.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. Exploitation requires only the specific configuration state change described, making the barrier to triggering the disclosure low, but the achievable impact is bounded.

Exploitation Scenarios

No public PoC is available for this CVE; the attack chain below is inferred directly from the NVD description and the vulnerability class (CWE-200, state-dependent filter failure).

1. Reconnaissance / target identification. An attacker identifies a Contao-powered site running an affected version (4.0.0 through 5.3.49 or 5.4.0 through 5.7.11). Fingerprinting can be performed via publicly observable Contao indicators in HTTP responses and page structure. The attacker does not need credentials or prior access.

2. Triggering the flaw. The disclosure depends on the site operator having (a) previously enabled contao.search.index_protected, causing protected pages to be indexed into tl_search, and subsequently (b) disabled that setting. In this configuration state, the protected-row filter is no longer applied to search queries. The attacker does not actively change the setting; they identify sites already in this state and interact with the public search functionality provided by ModuleSearch.

3. Data retrieval. The attacker submits search queries through the public ModuleSearch interface. Because the protected-row filter has been removed, results returned to the unauthenticated visitor include titles, URLs, and context snippets of protected pages that were indexed while protection was enabled. Extraction proceeds by iterating queries to enumerate indexed protected content.

4. Post-exploitation impact. The disclosed information serves as reconnaissance: the titles, URLs, and snippet text of protected pages can reveal internal site structure, administrative sections, sensitive topic areas, and content fragments. This intelligence can guide further targeted attacks. Importantly, per the NVD description, direct requests to the exposed pages still return an authorization response — the attacker gains metadata, not page access. There is no data modification or denial of service.

Impact Assessment

The blast radius is limited to confidentiality of search index metadata. CVSS subscores: Attack Vector Network (AV:N) — exploitable remotely over the web; Attack Complexity Low (AC:L) — no special conditions beyond the configuration state; Privileges Required None (PR:N) — anonymous visitors can trigger it; User Interaction None (UI:N) — no victim action needed; Scope Unchanged (S:U) — the vulnerable component and impacted component are the same; Confidentiality Low (C:L) — titles, URLs, and snippets, not full protected content; Integrity None (I:N); Availability None (A:N). Base score 5.3 (Medium).

Business impact centers on information leakage rather than system compromise. Organizations running affected Contao versions that have toggled contao.search.index_protected from enabled to disabled may inadvertently expose the existence and structure of protected pages, including administrative or members-only sections. This can aid attacker reconnaissance, enable more targeted social engineering, and leak sensitive content fragments. Regulatory and compliance implications may arise where exposed snippets contain personal or regulated data. Because page access controls remain enforced, the exposure does not constitute direct unauthorized access to protected resources.

The absence of public exploit code, a Nuclei template, and CISA KEV listing indicates no confirmed in-the-wild exploitation at the time of writing. EPSS has not yet been scored by FIRST.org; no EPSS value should be assumed.

Detection Guidance

Sigma Rule

title: Contao Search Disclosure - Config Change to index_protected
id: 3f7c9a21-5b4e-4d18-9c2a-7e1b6d0f4a53
status: experimental
description: Detects changes to the Contao configuration setting contao.search.index_protected which can enable disclosure of protected search metadata
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107842
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: contao
detection:
  keywords:
    - 'contao.search.index_protected'
    - 'index_protected'
  condition: keywords
level: medium

YARA Rule

rule CVE_2026_107842_Contao_Search_Disclosure
{
    meta:
        description = "Detects references to contao.search.index_protected configuration in Contao-related files"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107842"
        date = "2026-01-01"
    strings:
        $setting = "contao.search.index_protected" ascii wide nocase
        $table   = "tl_search" ascii wide nocase
        $module  = "ModuleSearch" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107842 Contao Search Disclosure Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"search"; nocase; http.header; content:"User-Agent"; reference:cve,2026-107842; classtype:attempted-recon; sid:2026107842; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and url.path : "*search*"]
  [network where network.protocol == "http" and url.path : "*search*" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_common
| search uri_path="*search*"
| where status=200
| stats count values(uri_query) as queries by src_ip
| where count > 5

Wazuh OSSEC Rule

<group name="contao,cve-2026-107842,">
  <rule id="107842" level="6">
    <decoded_as>json</decoded_as>
    <field name="setting">contao.search.index_protected</field>
    <description>CVE-2026-107842: Contao search index_protected setting changed - potential protected content disclosure</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). Confidence is limited because only the GHSA source asserts the fix; independent verification is recommended before relying on the patch alone.

1. Immediate mitigations. Audit the current state of contao.search.index_protected. If it was formerly enabled and then disabled, treat the search index as potentially contaminated. Until a patch is validated, consider re-enabling the setting or restricting public search access. Purge or rebuild the tl_search index to remove rows indexed while protection was enabled, so residual protected metadata no longer resides in the index. Review access logs for search queries originating from unexpected sources that may indicate reconnaissance.

2. Patch/upgrade steps. Upgrade to Contao 5.3.50 or 5.7.12, the versions in which the issue is reported fixed. Since patch confidence is CLAIMED from a single source, verify the fix in a staging environment and confirm that disabling contao.search.index_protected no longer results in protected rows being returned. After upgrading, rebuild the search index to ensure clean state.

3. Long-term hardening. Decouple the search index lifecycle from the global setting by ensuring that disabling protection also removes or re-filters previously indexed protected rows, rather than relying solely on a runtime filter. Enforce default-deny semantics in the search query layer so protected rows are excluded unless explicitly authorized. Monitor changes to search-related configuration for auditability, apply least-privilege access to CMS configuration, and include periodic reviews of the search index for residual sensitive content.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107842
• GitHub Security Advisory (GHSA) — patch source: https://github.com/advisories (search CVE-2026-107842)
• Contao official project / security advisories: https://contao.org
• Contao release notes 5.3.50 and 5.7.12
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

No public threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-107842. The CVE is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code is currently available.