CVE-2025-57759
BaseFortify
Publication date: 2025-08-28
Last updated on: 2025-09-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| contao | contao | From 5.3.0 (inc) to 5.3.38 (exc) |
| contao | contao | From 5.4.0 (inc) to 5.6.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Contao CMS to version 5.3.38 or 5.6.1, as these versions contain the patches that fix the improper privilege management issue. There are no workarounds available, so updating to the fixed versions is the only recommended mitigation. [1, 2]
Can you explain this vulnerability to me?
CVE-2025-57759 is a moderate severity vulnerability in the Contao CMS affecting versions 5.3.0 up to 5.3.37 and 5.6.0. It arises from improper privilege management where authenticated back end users with low privileges can edit fields of pages and articles without having the necessary permissions. This means users can modify content they should not be allowed to, impacting the integrity of the content. The vulnerability involves flaws in permission checks related to page types and article editing, allowing unauthorized content modification. It has been fixed in Contao versions 5.3.38 and 5.6.1, and no workarounds exist. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized back end users with low privileges to modify page and article content in the Contao CMS. Although it does not affect confidentiality or availability, it compromises the integrity of your website's content, potentially leading to unauthorized or malicious changes that could mislead users or damage your site's reputation. Attackers can exploit this vulnerability remotely with low complexity and no user interaction required. [1, 2]