CVE-2025-57759
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-28

Last updated on: 2025-09-02

Assigner: GitHub, Inc.

Description
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-28
Last Modified
2025-09-02
Generated
2026-06-16
AI Q&A
2025-08-28
EPSS Evaluated
2026-06-14
NVD
CVE-2025-57759
EUVD
EUVD-2025-26124
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
contao contao From 5.3.0 (inc) to 5.3.38 (exc)
contao contao From 5.4.0 (inc) to 5.6.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Contao CMS to version 5.3.38 or 5.6.1, as these versions contain the patches that fix the improper privilege management issue. There are no workarounds available, so updating to the fixed versions is the only recommended mitigation. [1, 2]

Executive Summary

CVE-2025-57759 is a moderate severity vulnerability in the Contao CMS affecting versions 5.3.0 up to 5.3.37 and 5.6.0. It arises from improper privilege management where authenticated back end users with low privileges can edit fields of pages and articles without having the necessary permissions. This means users can modify content they should not be allowed to, impacting the integrity of the content. The vulnerability involves flaws in permission checks related to page types and article editing, allowing unauthorized content modification. It has been fixed in Contao versions 5.3.38 and 5.6.1, and no workarounds exist. [1, 2, 3]

Impact Analysis

This vulnerability can impact you by allowing unauthorized back end users with low privileges to modify page and article content in the Contao CMS. Although it does not affect confidentiality or availability, it compromises the integrity of your website's content, potentially leading to unauthorized or malicious changes that could mislead users or damage your site's reputation. Attackers can exploit this vulnerability remotely with low complexity and no user interaction required. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-57759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart