Vulnerability · Published Aug 28, 2025 · Assigned by GitHub_M

CVE-2025-57759Contao has improper privilege management for page and article fields

Medium 4.3

In plain English

A medium-severity privilege mismanagement in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	contao/contao	5.3.38	GHSA-qqfq-7cpp-hcqj
Packagist	contao/contao	5.6.1	GHSA-qqfq-7cpp-hcqj
Packagist	contao/core-bundle	5.3.38	GHSA-qqfq-7cpp-hcqj
Packagist	contao/core-bundle	5.6.1	GHSA-qqfq-7cpp-hcqj

Affected products (as reported)

Vendor	Product	Versions
contao	contao	>= 5.3.0, < 5.3.38>= 5.4.0-RC1, < 5.6.1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqj x_refsource_CONFIRM
https://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851f x_refsource_MISC
https://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fields x_refsource_MISC