Most recent entries from all

EUVD-2026-251312

fkie_cve-2025-57759

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

GHSA-qqfq-7cpp-hcqj — Contao does not properly manage privileges for page and article fields

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

### Patches

Update to Contao 5.3.38 or 5.6.1.

### Workarounds

None.

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

WID-SEC-W-2025-1920 — Contao: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Contao ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.