VulnerabilityAnalyzed

CVE-2025-57759

Contao is an Open Source CMS.

MEDIUM 4.3EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-269
Affected: contao/contao
Source: security-advisories@github.com

References

https://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fieldsVendor Advisory
https://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851fPatch
https://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqjPatch, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.