Contao does not properly manage privileges for page and article fields
### Impact Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. ### Patches Update to Contao 5.3.38 or 5.6.1. ### Workarounds None. ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-57759US | — | — | ||
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articl… | ||||
02
references
External citations — patches, advisories, analysis.
- https://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fieldsWEB
- https://github.com/contao/contaoPACKAGE
- https://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851fWEB
- https://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-57759ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan