https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:08:26.910076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-251312 EUVD-2026-251312 2026-10-04T00:08:26.961507+00:00 EUVD-2026-251312 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57759 fkie_cve-2025-57759 2026-10-04T00:08:26.961544+00:00

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

 https://cve.radiocsirt.org/vuln/ghsa-qqfq-7cpp-hcqj GHSA-qqfq-7cpp-hcqj — Contao does not properly manage privileges for page and article fields 2026-10-04T00:08:26.961577+00:00

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1920 WID-SEC-W-2025-1920 — Contao: Mehrere Schwachstellen 2026-10-04T00:08:26.961610+00:00

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.