Contao Information Disclosure Vulnerability in Frontend Search Index

A vulnerability in Contao CMS versions 4.9.14 prior to 4.13.56, 5.3.38, and 5.6.1 allows protected content elements rendered as fragments to be indexed and publicly accessible through the frontend search. This issue has been addressed in versions 4.13.56, 5.3.38, and 5.6.1. Users can temporarily disable the frontend search as a workaround.

Impact

This vulnerability leads to unauthorized information disclosure by allowing protected content elements to be indexed and made publicly available in the frontend search.

Remediation

Users are advised to update to Contao versions 4.13.56, 5.3.38, or 5.6.1. Instructions for updating can be found in the Contao documentation.