CVE-2025-57758 — Improper Access Control in Contao

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.0%
top 87.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ContaoContao Core-bundle
Timeline
PublishedAug 28

Description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDcontao/contao5.3.0 — 5.3.38+1
▶Packagistcontao/contao5.0.0 — 5.3.38+1
▶Packagistcontao/core-bundle5.0.0 — 5.3.38+1
▶CVEListV5contao/contao>= 5.0.0, < 5.3.38, >= 5.4.0-RC1, < 5.6.1+1

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
Contao has improper access control in the back end voters↗2025-08-28
▶
GHSA
Contao applies improper access control in the back end voters↗2025-08-28
▶
OSV
Contao applies improper access control in the back end voters↗2025-08-28
▶