4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57759

CVE-2025-57759: Contao does not properly manage privileges for page and article fields

Impact

Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions.

Patches

Update to Contao 5.3.38 or 5.6.1.

Workarounds

None.

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57759

CVE-2025-57759:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
contao/core-bundle	composer	>= 5.3.0, < 5.3.38	5.3.38
contao/core-bundle	composer	>= 5.4.0-RC1, < 5.6.1	5.6.1
contao/contao	composer	>= 5.3.0, < 5.3.38	5.3.38
contao/contao	composer	>= 5.4.0-RC1, < 5.6.1	5.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-qqfq-7cpp-hcqj, stems from improper privilege management within Contao's back end. The core of the issue is that the system failed to consistently check for permissions related to page types when users performed actions on pages and articles. This allowed a logged-in back end user to potentially edit fields of pages and articles even if they did not have the explicit permissions for that specific page type.

The analysis of the patch commit 80ee7db12d55ad979d9b1b180f273d4e2668851f reveals several key changes made to address this flaw:

Missing Page Type Checks: The primary vulnerability was the absence of checks against ContaoCorePermissions::USER_CAN_ACCESS_PAGE_TYPE in critical security voters. The ArticleContentVoter::hasAccessToRecord function, for example, would grant access to an article's content without verifying if the user was allowed to interact with the parent page's type. The patch rectifies this by adding this check, ensuring that article modifications are governed by the parent page's type permissions.
Insufficient Permission Checks in Page Operations: The PagePermissionVoter was updated to incorporate page type checks for create and delete operations. Previously, a user's ability to create or delete a page was not restricted by the page type, leading to potential privilege escalation. The patched functions canCreate and canDelete now correctly enforce these permissions.
Logical Flaw in Update Check: A subtle but significant bug was fixed in PagePermissionVoter::canUpdate. The use of array_diff instead of array_diff_assoc created a loophole where certain modifications to a page's data would not be detected as changes, thereby bypassing the permission checks required for an update action. This could allow unauthorized edits to go through unchallenged.

The vulnerable functions identified are central to the authorization process for content and page management in Contao. An attacker exploiting this vulnerability would need to be an authenticated back end user. By manipulating requests to edit pages or articles, they could modify content that their assigned permissions should have restricted, leading to unauthorized information disclosure or content tampering.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-57759: Contao does not properly manage privileges for page and article fields

Impact

Patches

Workarounds

For more information

CVE-2025-57759:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

4.3

4.3

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2025-57759: Contao does not properly manage privileges for page and article fields

Impact

Patches

Workarounds

For more information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI