Core bundle: Contao: Improper access control in the preview links module (CVE-2026-107850)

The vulnerability arises because the service configuration references a class named PreviewAccessVoter, but the actual class shipped is named PreviewVoter. Symfony fails to register this class as a voter due to this mismatch, causing the private service to be removed during container compilation without warning. Consequently, the ownership rule in PreviewVoter::hasAccess() is never executed. The database table tl_preview_link lacks a SQL filter on the createdBy field, so any non-administrator back end user whose group has the preview_link module permission can read all preview links on the installation. Using these signed share URLs allows front end preview of target pages with showUnpublished enabled and no page permission checks, exposing unpublished or embargoed content to unauthorized users and anyone they share the URLs with. Attempts to update records owned by others are denied by DcaPermissionVoter, so unauthorized editing or deletion of preview links is not possible.

Non-administrator back end users with the preview_link module permission can access all preview links, including those created by administrators. This grants unauthorized front end preview access to unpublished or embargoed pages without any permission checks, potentially exposing sensitive content. However, unauthorized modification or deletion of preview links is prevented by existing permission voters. There are no known exploits in the wild.

A patch is available for Contao core-bundle to correct the class name and properly register the preview access voter, restoring intended access controls. Users should update to a fixed version at or beyond 5.7.12. No additional mitigation steps are indicated by the vendor advisory.