Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
References
Configurations
Configuration 1 (hide)
|
History
02 Sep 2025, 17:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters - Vendor Advisory | |
| References | () https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7 - Patch | |
| References | () https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v - Third Party Advisory | |
| First Time |
Contao contao
Contao |
|
| CPE | cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* |
28 Aug 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-28 17:15
Updated : 2025-09-02 17:37
NVD link : CVE-2025-57758
Mitre link : CVE-2025-57758
CVE.ORG link : CVE-2025-57758
JSON object : View
Products Affected
contao
- contao
CWE
CWE-284
Improper Access Control