Vulnerability · Published Aug 28, 2025 · Assigned by GitHub_M

CVE-2025-57758Contao has improper access control in the back end voters

Medium 4.3

In plain English

A medium-severity improper access control in contao from contao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	contao/contao	5.3.38	GHSA-7m47-r75r-cx8v
Packagist	contao/contao	5.6.1	GHSA-7m47-r75r-cx8v
Packagist	contao/core-bundle	5.3.38	GHSA-7m47-r75r-cx8v
Packagist	contao/core-bundle	5.6.1	GHSA-7m47-r75r-cx8v

Affected products (as reported)

Vendor	Product	Versions
contao	contao	>= 5.0.0, < 5.3.38>= 5.4.0-RC1, < 5.6.1

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v x_refsource_CONFIRM
https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7 x_refsource_MISC
https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters x_refsource_MISC