CVE-2025-57758
📋 TL;DR
This vulnerability allows authenticated back-end users in Contao CMS to access modules they shouldn't have permission to view. It affects Contao installations from version 5.0.0 up to (but not including) 5.3.38 and 5.6.1. The issue stems from improper access control in the table access voter component.
💻 Affected Systems
- Contao CMS
📦 What is this software?
Contao by Contao
Contao by Contao
⚠️ Risk & Real-World Impact
Worst Case
Privilege escalation where authenticated users gain unauthorized access to administrative modules, potentially leading to data exposure or unauthorized content modifications.
Likely Case
Users with limited back-end access can view or interact with modules beyond their assigned permissions, violating the principle of least privilege.
If Mitigated
With proper module-level access controls and the workaround implemented, users are restricted to their assigned modules only.
🎯 Exploit Status
Exploitation requires valid back-end user credentials. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.38 or 5.6.1
Vendor Advisory: https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters
Restart Required: No
Instructions:
1. Backup your Contao installation and database. 2. Update Contao to version 5.3.38 (if on 5.3.x branch) or 5.6.1 (if on 5.4.x-5.6.x branch). 3. Clear the cache via Contao back-end or command line. 4. Verify the update was successful.
🔧 Temporary Workarounds
Implement USER_CAN_ACCESS_MODULE checks
allAdd additional access control checks in custom modules to verify users have proper module permissions.
Implement custom access control logic in affected modules using USER_CAN_ACCESS_MODULE checks as described in the advisory
🧯 If You Can't Patch
- Implement the workaround of adding USER_CAN_ACCESS_MODULE checks to all custom modules
- Restrict back-end user permissions to minimum required and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Contao version via back-end System → Settings or via command line: php vendor/bin/contao-console contao:versionCheck Version:
php vendor/bin/contao-console contao:versionVerify Fix Applied:
Verify version is 5.3.38 or higher (for 5.3.x branch) or 5.6.1 or higher (for 5.4.x-5.6.x branch). Test that users cannot access unauthorized modules.📡 Detection & Monitoring
Log Indicators:
- Unusual back-end module access patterns
- Users accessing modules outside their typical scope
- Access denied errors for modules users shouldn't be trying to access
Network Indicators:
- Increased back-end authentication attempts
- Unusual API calls to back-end modules
SIEM Query:
source="contao_logs" AND (event="module_access" OR event="access_denied") | stats count by user, module