https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T17:55:47.061983+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-10434 cnvd-2020-10434 2026-10-15T17:55:47.064903+00:00 cnvd-2020-10434 https://cve.radiocsirt.org/vuln/euvd-2026-59486 EUVD-2026-59486 2026-10-15T17:55:47.064934+00:00 EUVD-2026-59486 https://cve.radiocsirt.org/vuln/fkie_cve-2019-19712 fkie_cve-2019-19712 2026-10-15T17:55:47.064948+00:00

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

 https://cve.radiocsirt.org/vuln/ghsa-4mvc-qc5w-v5qr GHSA-4mvc-qc5w-v5qr — Information disclosure in the Contao backend 2026-10-15T17:55:47.064975+00:00

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/information-disclosure-in-the-back-end

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/gsd-2019-19712 gsd-2019-19712 2026-10-15T17:55:47.065009+00:00 gsd-2019-19712