Medium severity · published Aug 28, 2025
CVE-2025-57758
Contao has improper access control in the back end voters
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
contao · contao
>= 5.0.0, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57758
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57758
Vendor Advisory
https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters
Patch
https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7
Third Party Advisory
https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v
More from contao
9.8
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter
9.8
CVE-2019-11512
Contao 4.x allows SQL Injection
9.3
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
8.8
CVE-2024-45398
Contao is an Open Source CMS
8.8
CVE-2012-4383
contao prior to 2.11.4 has a sql injection vulnerability