{"action":"Upgrade contao/core-bundle to 5.3.50 or later.","affected":[{"fixed":"5.3.50","introduced":"4.0.0"},{"fixed":"5.7.12","introduced":"5.4.0-RC1"}],"component":"contao/core-bundle","cve_ids":["CVE-2026-107842"],"ecosystem":"Packagist","epss":0.00262,"exploited":false,"fixed_versions":["5.3.50","5.7.12"],"ghsa_id":"GHSA-x2rp-9qf7-2fmq","id":"tcs_01M5KFAJ2T1CXY2W2H8HHHD2XV","modified_at":"2026-10-09T21:00:16.040827452Z","published_at":"2026-10-09T20:54:09Z","references":["https://osv.dev/vulnerability/GHSA-x2rp-9qf7-2fmq","https://github.com/contao/contao/security/advisories/GHSA-x2rp-9qf7-2fmq","https://github.com/contao/contao/commit/572686a113bca60f92cf2d0496cf3a74d0b6b457","https://github.com/contao/contao","https://github.com/contao/contao/releases/tag/5.3.50","https://github.com/contao/contao/releases/tag/5.7.12"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-x2rp-9qf7-2fmq","url":"https://osv.dev/vulnerability/GHSA-x2rp-9qf7-2fmq"}],"summary":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled"}