Presentation
The Contao newsletter bundle manages newsletter channels, their recipients and the sending of campaigns. Back office users are normally scoped to the channels they are allowed to manage.
HDW Sec found that the module’s key actions do not re-check that scope, so a back office user can act on a channel that is not theirs.
Issue(s)
- The channel identifier is taken from the request and used without an authorization check on the target (insecure direct object reference).
- Both the sending action and the recipient import are reachable this way, so a user scoped to one channel can operate on another.
- Confirmed live end to end on a self-hosted lab: recipients were imported into a channel outside the account’s scope.
- The impact is on integrity, and it extends outside the application: an attacker can have the site send a campaign from a channel they do not own.
References
- GitHub advisory: GHSA-3r9g-pfhv-3228
- Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.