CVE-2025-57759CWE-269

Contao has improper privilege management for page and article fields

Medium · published August 28, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-08-28T16:32Z
EPSS history
Timeline
  • 28 AUG 16:32Z
    Contao has improper privilege management for page and article fields
    cvelistv5