CVE-2025-57759: Contao Core Bundle and Contao Improper Privilege Management Vulnerability
Summary
CVE-2025-57759: Contao does not properly manage privileges for page and article fields. Affects contao/core-bundle across 2 version ranges.
>= 5.3.0, < 5.3.38
>= 5.4.0-RC1, < 5.6.1
Fixed in 5.3.38 or 5.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Contao is an open-source content management system (CMS) that enables users to create and manage websites with ease. It offers a flexible framework, allowing developers to build custom themes and extensions. The core bundle of Contao provides essential functionalities for managing content, users, and permissions. However, a vulnerability has been identified that affects the privilege management system, potentially allowing unauthorized access to sensitive features.
Vulnerability Detail
The vulnerability arises from improper management of user permissions within the Contao CMS. Under certain conditions, back-end users may gain the ability to edit fields of pages and articles without possessing the necessary permissions. This flaw can lead to unauthorized modifications, potentially compromising the integrity of the website's content and user data. The vulnerability is classified under CWE-269, which pertains to improper privilege management.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3.0, < 5.3.385.3.38composer require contao/core-bundle:5.3.38 -
>= 5.4.0-RC1, < 5.6.15.6.1composer require contao/core-bundle:5.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to update to the patched versions mentioned above.
Conclusion
In summary, CVE-2025-57759 is a moderate severity vulnerability in the Contao CMS that allows unauthorized editing of page and article fields due to improper privilege management. Users are strongly advised to update to the patched versions to secure their applications.
See every vulnerability recorded for contao/core-bundle →
FAQ
CVE-2025-57759 is a vulnerability in the Contao CMS that allows unauthorized users to edit page and article fields due to improper privilege management.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects Contao versions 5.3.0 to 5.3.38 and 5.4.0-RC1 to 5.6.1. It is recommended to update to the latest patched versions.
The risks include unauthorized access to sensitive content, potential data manipulation, and overall compromise of the website's integrity.
Unfortunately, there are no workarounds available for this vulnerability. Updating to the patched versions is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core-bundle.
