4.3

CVE-2025-57758

Contao has improper access control in the back end voters

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Contao ≫ Contao Version >= 5.3.0 < 5.3.38
Contao ≫ Contao Version >= 5.4.0 < 5.6.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.13
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v
Third Party Advisory
https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7
Patch
https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters
Vendor Advisory