GitHub Advisoryadvisory · Packagist

GHSA-qqfq-7cpp-hcqj Contao does not properly manage privileges for page and article fields

MEDIUM Published 2025-08-28 Modified 2025-08-28 Official page ↗
Aliases
CVE-2025-57759
Ecosystem
Packagist
Packages
contao/core-bundle, contao/contao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-269
Reviewed
2025-08-28

Affected packages

• Packagist contao/core-bundle: >= 5.3.0, < 5.3.38 → fixed in 5.3.38 • Packagist contao/core-bundle: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1 • Packagist contao/contao: >= 5.3.0, < 5.3.38 → fixed in 5.3.38 • Packagist contao/contao: >= 5.4.0-RC1, < 5.6.1 → fixed in 5.6.1

Description

Impact Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. Patches Update to Contao 5.3.38 or 5.6.1. Workarounds None. For more information If you have any questions or comments about this advisory, open an issue in contao/contao.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References