Most recent entries from all

EUVD-2026-251313

fkie_cve-2025-57758

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

GHSA-7m47-r75r-cx8v — Contao applies improper access control in the back end voters

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

Do not rely solely on the voter and additionally check `USER_CAN_ACCESS_MODULE`.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

WID-SEC-W-2025-1920 — Contao: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.