4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57758

CVE-2025-57758: Contao applies improper access control in the back end voters

Impact

The table access voter in the back end doesn't check if a user is allowed to access the corresponding module.

Patches

Update to Contao 5.3.38 or 5.6.1.

Workarounds

Do not rely solely on the voter and additionally check USER_CAN_ACCESS_MODULE.

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57758

CVE-2025-57758:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
contao/core-bundle	composer	>= 5.0.0, < 5.3.38	5.3.38
contao/core-bundle	composer	>= 5.4.0-RC1, < 5.6.1	5.6.1
contao/contao	composer	>= 5.0.0, < 5.3.38	5.3.38
contao/contao	composer	>= 5.4.0-RC1, < 5.6.1	5.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is an improper access control issue within the TableAccessVoter of Contao's core bundle. The analysis of the provided patch commit 3f05c603e1c94d34819f837f060df5d66447d0d7 clearly indicates that the vote method was missing a critical permission check.

The patch introduces a new private method, hasAccessToModule, and, more importantly, adds a call to this method at the beginning of the vote function. The added code block if (!$this->hasAccessToModule($token, $subject->getDataSource())) { return self::ACCESS_DENIED; } serves as the fix. Its absence in the vulnerable versions is the root cause of the issue.

Therefore, the Contao\CoreBundle\Security\Voter\DataContainer\TableAccessVoter::vote function is the specific entry point of the vulnerability. When this function is called during an exploitation attempt, it would have previously failed to check for module-level access, granting unauthorized access. The runtime profile during such an event would prominently feature this function in the call stack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-57758: Contao applies improper access control in the back end voters

Impact

Patches

Workarounds

For more information

CVE-2025-57758:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

4.3

4.3

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-57758: Contao applies improper access control in the back end voters

Impact

Patches

Workarounds

For more information

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI