Vulnerability Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 5.3.0, < 5.3.38 |
Related Weaknesses (CWE)
References
- https://contao.org/en/security-advisories/improper-access-control-in-the-back-enVendor Advisory
- https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7Patch
- https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8vThird Party Advisory
FAQ
What is CVE-2025-57758?
CVE-2025-57758 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding modul...
How severe is CVE-2025-57758?
CVE-2025-57758 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-57758?
Check the references section above for vendor advisories and patch information. Affected products include: Contao Contao.