GHSA-7m47-r75r-cx8vMediumCVSS 4.3
Contao applies improper access control in the back end voters
🔗 CVE IDs covered (1)
📋 Description
Impact
The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.
Patches
Update to Contao 5.3.38 or 5.6.1.
Workarounds
Do not rely solely on the voter and additionally check USER_CAN_ACCESS_MODULE.
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
🎯 Affected products4
- composer/contao/core-bundle:>= 5.0.0, < 5.3.38
- composer/contao/core-bundle:>= 5.4.0-RC1, < 5.6.1
- composer/contao/contao:>= 5.0.0, < 5.3.38
- composer/contao/contao:>= 5.4.0-RC1, < 5.6.1
🔗 References (5)
- https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v
- https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7
- https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters
- https://nvd.nist.gov/vuln/detail/CVE-2025-57758
- https://github.com/advisories/GHSA-7m47-r75r-cx8v