[MEDIUM] Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

PKSA-bmqh-y7sv-p1st CVE-2026-107842 GHSA-x2rp-9qf7-2fmq

Affected package: contao/core-bundle

Affected version: >=5.4.0-RC1,<5.7.12|>=4.0.0,<5.3.50

Reported by:
GitHub