Presentation
Contao’s preview links let a back office user generate a shareable URL that exposes unpublished content for review.
HDW Sec found that the module never checks that the preview link belongs to the user acting on it, so a back office user can reach links created by someone else.
Issue(s)
- The voter that should decide ownership of a preview link is never registered, so no authorization decision is made on the record.
- The link identifier comes straight from the request and is used as-is (insecure direct object reference).
- A back office user can therefore read or act on preview links belonging to other users, and reach the unpublished content behind them.
- This one is narrower than the other access-control findings in the set: it was introduced in 5.7.1, so only the 5.7 line is affected and only 5.7.12 carries the fix.
References
- GitHub advisory: GHSA-q6wp-fr43-gm9v
- Fixed in Contao 5.7.12, published 2026-08-25. No CVE assigned as of publication.