CVE-2025-57758CWE-284

Contao has improper access control in the back end voters

Medium · published August 28, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-08-28T16:32Z
EPSS history
Timeline
  • 28 AUG 16:32Z
    Contao has improper access control in the back end voters
    cvelistv5