Core bundle: Contao: Improper access control in the table access voter (CVE-2026-107851)

Contao's backend access control uses a security voter (TableAccessVoter) to enforce per-table permissions based on user group assignments. The voter caches access decisions keyed only by the user's security token, ignoring the specific table being checked. Consequently, if a user is allowed access to one table, that positive result is incorrectly reused for subsequent checks on other tables within the same request, even if the user lacks permission for those tables. This caching flaw combined with a permissive fallback voter (DefaultDataContainerVoter) leads to unauthorized access to tables including those containing sensitive personal data. Only a limited set of tables have additional table-specific checks to mitigate this issue. The vulnerability affects Contao core-bundle versions >=5.7.0 and <5.7.12.

Low-privileged, non-admin backend users can gain unauthorized access to database tables outside their assigned permissions, including sensitive personal data such as frontend member records and newsletter subscriber email addresses. This unauthorized access includes read, create, update, and delete operations on affected tables. The flaw undermines Contao's intended access control model at the table level.

A patch is available and should be applied to Contao core-bundle versions >=5.7.0 and <5.7.12 to correct the caching logic in the TableAccessVoter. Applying the official fix will prevent unauthorized access due to the caching defect. No alternative mitigations are indicated by the vendor advisory.