{"metadata": {"vulnerability": "CVE-2026-107842", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-08T22:34:49.291Z", "date_only": false, "value": "2026-10-08T22:34:49.291Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-107842", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-09T19:02:30.677Z", "date_only": false, "value": "2026-10-09T19:02:30.677Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-107842", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-09T19:02:30.677Z", "date_only": false, "value": "2026-10-09T19:02:30.677Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-107842", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-09T19:16:57.477Z", "date_only": false, "value": "2026-10-09T19:16:57.477089Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117412555450563250", "record": "CVE-2026-107842", "field": "creation_timestamp", "uuid": "9da054db-e9ce-4264-995e-25b1228e27be", "content": "CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. The protected pages continue to return an authorization response, so this issue exposes search metadata and indexed text rather than bypassing page access. This issue is fixed in versions 5.3.50 and 5.7.12.\nhttps://www.cve.org/CVERecord?id=CVE-2026-107842https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmqhttps://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457https://github.com/contao/contao/releases/tag/5.3.50https://github.com/contao/contao/releases/tag/5.7.12#contao#CVE_2026_107842#bot", "url": "https://infosec.exchange/users/cve/statuses/117412555450563250"}, {"timestamp": "2026-10-09T20:17:10.013Z", "date_only": false, "value": "2026-10-09T20:17:10.013", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107842", "record": "FKIE_CVE-2026-107842", "field": "published"}, {"timestamp": "2026-10-09T20:54:09Z", "date_only": false, "value": "2026-10-09T20:54:09Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X2RP-9QF7-2FMQ", "record": "GHSA-X2RP-9QF7-2FMQ", "field": "published"}, {"timestamp": "2026-10-09T20:54:09Z", "date_only": false, "value": "2026-10-09T20:54:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X2RP-9QF7-2FMQ", "record": "GHSA-X2RP-9QF7-2FMQ", "field": "modified"}, {"timestamp": "2026-10-10T18:30:30Z", "date_only": false, "value": "2026-10-10T18:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/0d705c8bb1bee26282cf933174234bde", "record": "CVE-2026-107842", "field": "creation_timestamp", "uuid": "080a6d64-fc6e-44dd-b547-8670cf7d828c", "content": "# CVE-2026-107842: CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-09\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107842\n\n## Summary\nAn information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.\n\n## TL;DR\nContao's ModuleSearch failed to filter out stale protected page index entries from database table tl_search when contao.search.index_protected configuration was set to false, resulting in sensitive content disclosure in search results.\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00262 (16.62th percentile)\n- **Impact**: Partial Information Disclosure\n- **Exploit Status**: Unproven / No Public Exploits\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Contao CMS 4.0.0 before 5.3.50\n- Contao CMS 5.4.0-RC1 before 5.7.12\n- **contao/contao**: >= 4.0.0, < 5.3.50 (Fixed in: `5.3.50`)\n- **contao/contao**: >= 5.4.0-RC1, < 5.7.12 (Fixed in: `5.7.12`)\n\n## Mitigation\n\n- Upgrade contao/contao package to patched version 5.3.50 or 5.7.12.\n- Rebuild and purge the search index via the Contao Maintenance backend panel if index_protected configuration was modified.\n\n**Remediation Steps:**\n1. Run 'composer update contao/contao --with-dependencies' in project root.\n2. Log in to Contao Backend and open the Maintenance module.\n3. Purge the Search Index database table tl_search.\n4. Rebuild search index to ensure only current public pages are indexed.\n\n## References\n\n- [GitHub Security Advisory GHSA-x2rp-9qf7-2fmq](https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq)\n- [Contao Patch Commit 572686a113bca60f92cf2d0496cf3a74d0b6b457](https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457)\n- [Contao Release Tag 5.3.50](https://github.com/contao/contao/releases/tag/5.3.50)\n- [Contao Release Tag 5.7.12](https://github.com/contao/contao/releases/tag/5.7.12)\n- [NVD Detail CVE-2026-107842](https://nvd.nist.gov/vuln/detail/CVE-2026-107842)\n- [CVE Record CVE-2026-107842](https://www.cve.org/CVERecord?id=CVE-2026-107842)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107842) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/0d705c8bb1bee26282cf933174234bde"}, {"timestamp": "2026-10-13T20:19:08.676Z", "date_only": false, "value": "2026-10-13T20:19:08.676065Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107842", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T20:19:08.676Z", "date_only": false, "value": "2026-10-13T20:19:08.676065Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107842", "record": "FKIE_CVE-2026-107842", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T20:26:18.278Z", "date_only": false, "value": "2026-10-13T20:26:18.278Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-107842", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:26:18.278Z", "date_only": false, "value": "2026-10-13T20:26:18.278Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-107842", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T21:17:32.917Z", "date_only": false, "value": "2026-10-13T21:17:32.917", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-107842", "record": "FKIE_CVE-2026-107842", "field": "lastModified"}]}