CVE-2026-107851: Contao: Improper access control in the table access voter

Due to a caching defect in the security voter that governs table-level access to Contao’s Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses.