- Package
- contao/core-bundle
- Fixed in
- 5.7.12
- Published
- Fri 9 Oct 2026, 21:53 LisbonUpdated Mon 26 Oct 2026, 03:27 Lisbon
- Installs on Packagist
- 2M
In plain words
A non administrator back end user whose group has access to the preview links module can read every preview link, including those created by administrators. The signed share URLs let that user, or anyone they pass them to, preview the target pages without page permission checks, exposing unpublished or embargoed content. The advisory does not claim that other users' preview links can be edited or deleted.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| contao/core-bundle | >= 5.7.1, < 5.7.12 | 5.7.12 |
Am I affected?
Check composer.lock for contao/core-bundle at version >= 5.7.1, < 5.7.12; the fix is 5.7.12. Check whether any non administrator back end user's group has the preview_link module, and whether preview links in tl_preview_link expose pages that those users should not be able to preview.
What to do
Check which version you have, then update to a fixed release for your branch (5.7.12):
composer show contao/core-bundle | grep versions
composer update contao/core-bundleIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass($class, false), gets null, silently skips the interface based autoconfiguration that would have tagged it as a voter, and the now untagged private service is removed when the container is compiled. The application boots without a warning, and the ownership rule in PreviewVoter::hasAccess() is never executed. tl_preview_link has no compensating SQL filter on createdBy, so any non administrator back end user whose group holds the preview_link module reads every preview link on the installation and lifts the already signed share URLs straight out of the list. Following one grants front end preview of the target page, with showUnpublished and with no page permission check, to anyone at all.
Impact
A non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with showUnpublished and with no page permission check at all, so unpublished or embargoed content becomes readable by a user who has no rights on those pages, and by anyone that user forwards the URL to.
Honesty caveat, stated because it bounds the severity. UpdateAction on a record owned by someone else was denied in our lab by DcaPermissionVoter, so we do not claim that a foreign preview link can be edited or deleted.
Weakness: CWE-639 Authorization Bypass Through User-Controlled Key; CWE-862 Missing Authorization. Reported by HDWSec.
The advisory
- GitHub Advisory Database: GHSA-q6wp-fr43-gm9v, with who is affected and how
- OSV.dev: GHSA-q6wp-fr43-gm9v
- The week's digest, with the other advisories from 5 Oct 2026
- All advisories for contao/core-bundle