Contao: Improper access control in the preview links module
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.