CVEvulnerability
CVE-2025-57758
4.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-08-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-284
Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Affected configurations
• contao contao (>= 5.3.0 < 5.3.38)
• contao contao (>= 5.4.0 < 5.6.1)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness