- Package
- contao/core-bundle
- Fixed in
- 5.3.50, 5.7.12
- Published
- Fri 9 Oct 2026, 21:54 LisbonUpdated Mon 26 Oct 2026, 03:27 Lisbon
- Installs on Packagist
- 2M
In plain words
Anonymous visitors can see member-only page titles, URLs and indexed text in site search results if protected pages were indexed while contao.search.index_protected was enabled and the setting was then disabled. Disabling it removes the search filter but leaves the indexed rows in place. The pages themselves remain access-controlled, so this does not let visitors open protected pages.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| contao/core-bundle | >= 4.0.0, < 5.3.50 | 5.3.50 |
| contao/core-bundle | >= 5.4.0-RC1, < 5.7.12 | 5.7.12 |
Am I affected?
Check composer.lock for contao/core-bundle versions >= 4.0.0, < 5.3.50 or >= 5.4.0-RC1, < 5.7.12. If affected, check whether contao.search.index_protected was enabled when protected pages were indexed and has since been disabled. Check whether those protected-page rows remain in tl_search and whether the site uses ModuleSearch to return search results. Fixed versions are 5.3.50 and 5.7.12.
What to do
Check which version you have, then update to a fixed release for your branch (5.3.50, 5.7.12):
composer show contao/core-bundle | grep versions
composer update contao/core-bundleIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.index_protected, but the authorisation data lives per row in tl_search. Turning the setting off removes
the filter without removing the rows, so protected pages that were indexed while it was on are returned to unauthenticated visitors such as title, URL and context snippet, even though the pages themselves still answer 401.
Impact
Disclosure of member-only page titles, URLs and indexed text to unauthenticated visitors through the site search. The pages themselves remain access-controlled, so this is not a page-access bypass.
Credits
This security vulnerability was found by @iRevivalx .
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. Reported by iRevivalx.
The advisory
- GitHub Advisory Database: GHSA-x2rp-9qf7-2fmq, with who is affected and how
- OSV.dev: GHSA-x2rp-9qf7-2fmq
- The week's digest, with the other advisories from 5 Oct 2026
- All advisories for contao/core-bundle