CVE-2025-57758

4.3 mediumEPSS 0.3%

Medium (4.3) in contao contao. EPSS 0.3% chance of exploitation in the next 30 days.

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2025-08-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

contao:contao

References

https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters
https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7
https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v

Check your stack JSON