CVE-2021-37627
mediumpriority · track · 29EPSS 0.010 · 63 %ileEUUSEPSS · scored 2026-10-27
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form generator or disable the login for untrusted back end users.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (21)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-hq5m-mqmx-fw6mPrivilege escalation via form generator2021-08-23ghsa · osvUS
### Impact It is possible for untrusted users to gain administrator rights with the form generator. Installations are only affected if there are untrusted back end users with access to the form generator. ### Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. ### Workarounds Disable the form generator or disable the login for untrusted back end users. ### References https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.htmlcnnvd
- https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6mcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-37627cnnvd
- https://vigilance.fr/vulnerability/Contao-privilege-escalation-via-Form-Generator-36128cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021081609cnnvd
- https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.htmlenisa_euvd
- https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6menisa_euvd
- https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan