CVE-2025-57758: Contao has improper access control in the back end voters
Impact
The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.
Patches
Update to Contao 5.3.38 or 5.6.1.
Workarounds
Do not rely solely on the voter and additionally check USERCANACCESSMODULE.
For more information
If you have any questions or comments about this advisory, open an issue in contao/contao.
Other sources
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USERCANACCESSMODULE.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57758?
CVE-2025-57758 is categorized as a vulnerability that leads to improper access control.
How do I fix CVE-2025-57758?
To fix CVE-2025-57758, update to Contao 5.3.38 or 5.6.1.
What are the potential risks of CVE-2025-57758?
The risks of CVE-2025-57758 include unauthorized access to modules that should be restricted.
What should I do if I cannot apply the patch for CVE-2025-57758?
If unable to apply the patch for CVE-2025-57758, ensure to check 'USER_CAN_ACCESS_MODULE' in addition to using the voter.
Is CVE-2025-57758 applicable to all versions of Contao?
CVE-2025-57758 affects versions of Contao between 5.0.0 and 5.6.1.