https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 04:14:00 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107850 <p>Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.</p> <p>Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107850 https://vulnerability.circl.lu/vuln/ghsa-q6wp-fr43-gm9v <p><strong>Affected:</strong> Packagist: contao/core-bundle</p> <p>`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter`, but the class shipped on disk is named `PreviewVoter`. Symfony resolves the class with `getReflectionClass($class, false)`, gets `null`, silently skips the interface based autoconfiguration that would have tagged it as a voter, and the now untagged private service is removed when the container is compiled. The application boots without a warning, and the ownership rule in `PreviewVoter::hasAccess()` is never executed. `tl_preview_link` has no compensating SQL filter on `createdBy`, so any non administrator back end user whose group holds the `preview_link` module reads every preview link on the installation and lifts the already signed share URLs straight out of the list. Following one grants front end preview of the target page, with `showUnpublished` and with no page permission check, to anyone at all.</p> <p>### Impact</p> <p>A non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with `showUnpublished` and with no page permission check at all, so unpublished or embargoed content becomes readable by a user who has no rights on those pages, and by anyone that user forwards the URL to.</p> <p>**Honesty caveat, stated because it bounds the severity.** `UpdateActi…</p> <p><strong>Affected:</strong> Packagist: contao/core-bundle</p> <p>`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter`, but the class shipped on disk is named `PreviewVoter`. Symfony resolves the class with `getReflectionClass($class, false)`, gets `null`, silently skips the interface based autoconfiguration that would have tagged it as a voter, and the now untagged private service is removed when the container is compiled. The application boots without a warning, and the ownership rule in `PreviewVoter::hasAccess()` is never executed. `tl_preview_link` has no compensating SQL filter on `createdBy`, so any non administrator back end user whose group holds the `preview_link` module reads every preview link on the installation and lifts the already signed share URLs straight out of the list. Following one grants front end preview of the target page, with `showUnpublished` and with no page permission check, to anyone at all.</p> <p>### Impact</p> <p>A non administrator back end user reads every preview link on the installation, including links created by administrators, and lifts the already signed share URLs out of the list. Following one grants front end preview of the target page with `showUnpublished` and with no page permission check at all, so unpublished or embargoed content becomes readable by a user who has no rights on those pages, and by anyone that user forwards the URL to.</p> <p>**Honesty caveat, stated because it bounds the severity.** `UpdateActi…</p> https://vulnerability.circl.lu/vuln/ghsa-q6wp-fr43-gm9v