CVE-2025-57758: Contao CMS Authentication Bypass Vulnerability

CVE-2025-57758 Overview

Contao is an open source content management system (CMS) written in PHP. CVE-2025-57758 is an improper access control vulnerability [CWE-284] in the Contao back end. The table access voter fails to check whether an authenticated user is permitted to access the corresponding module before granting table-level access decisions. The issue affects Contao versions from 5.0.0 up to (but not including) 5.3.38 and 5.6.1. Authenticated back-end users with limited permissions can leverage the flaw to interact with data containers they should not reach.

Critical Impact
Authenticated back-end users can bypass module-level access restrictions and interact with data container tables outside their assigned scope, leading to unauthorized data modification.

Affected Products

Contao CMS versions 5.0.0 through 5.3.37
Contao CMS versions 5.4.0 through 5.6.0
Contao core-bundle component (contao:contao)

Discovery Timeline

2025-08-28 - CVE-2025-57758 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57758

Vulnerability Analysis

The defect resides in the TableAccessVoter used by Contao's back-end security layer. Symfony voters are invoked during authorization decisions to determine whether a token holds a given permission on a subject. Contao's table access voter evaluates whether the current user can perform actions such as create, read, update, or delete on a data container table. However, the voter did not additionally verify that the user was authorized to access the corresponding back-end module. As a result, authorization was granted at the table level without confirming the module-level access constraint (USER_CAN_ACCESS_MODULE). An authenticated back-end user with restricted module rights could therefore obtain access to tables they should not reach.

Root Cause

The root cause is missing authorization logic in the abstract data container voter. The class implemented Symfony's generic VoterInterface and made decisions based only on table-scoped attributes. Module membership was assumed to be enforced elsewhere in the request pipeline and was not re-checked at the voter. This violates the principle of complete mediation and constitutes broken access control [CWE-284].

Attack Vector

Exploitation requires an authenticated session on the Contao back end with low privileges. The attacker issues back-end requests targeting data container tables mapped to modules outside their permission set. Because the voter grants access without consulting module permissions, the request is authorized. Impact is limited to integrity of back-end managed content; the CVSS vector indicates no confidentiality or availability impact.

php

// Patch excerpt: core-bundle/src/Security/Voter/DataContainer/AbstractDataContainerVoter.php
 use Contao\CoreBundle\Security\DataContainer\UpdateAction;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\CacheableVoterInterface;
-use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;

-abstract class AbstractDataContainerVoter implements VoterInterface, CacheableVoterInterface
+abstract class AbstractDataContainerVoter implements CacheableVoterInterface
 {
     public function supportsAttribute(string $attribute): bool
     {

// Patch excerpt: core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php
 use Contao\CoreBundle\Security\ContaoCorePermissions;
 use Contao\CoreBundle\Security\DataContainer\CreateAction;
+use Contao\CoreBundle\Security\DataContainer\DeleteAction;
+use Contao\CoreBundle\Security\DataContainer\ReadAction;
 use Contao\CoreBundle\Security\DataContainer\UpdateAction;
 use Contao\DataContainer;
 use Contao\DC_File;
// Source: https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7

The patch removes the direct VoterInterface inheritance from AbstractDataContainerVoter and expands TableAccessVoter to explicitly handle ReadAction, DeleteAction, and UpdateAction while enforcing the USER_CAN_ACCESS_MODULE permission.

Detection Methods for CVE-2025-57758

Indicators of Compromise

Back-end HTTP requests from low-privileged users targeting /contao?do=<module> paths outside their assigned modules.
Unexpected write, update, or delete operations logged against data container tables in the Contao tl_log table.
Session activity showing user IDs performing actions on tables their group permissions do not enumerate.

Detection Strategies

Review Contao back-end audit logs (tl_log) for actions attributed to users whose group configuration does not include the affected module.
Correlate web server access logs with Contao user-group module assignments to flag requests to unauthorized do= targets.
Enable verbose Symfony security logging to capture voter decisions and identify unexpected ACCESS_GRANTED outcomes on data container attributes.

Monitoring Recommendations

Alert on privilege-scoped anomalies where a back-end user performs create, update, or delete actions across tables not previously touched.
Monitor deployed Contao versions across the estate and flag hosts still running versions prior to 5.3.38 or 5.6.1.
Track authenticated session activity for lateral movement within the CMS administration interface.

How to Mitigate CVE-2025-57758

Immediate Actions Required

Upgrade Contao to version 5.3.38 or 5.6.1 (or later) using Composer to receive the fixed TableAccessVoter implementation.
Audit back-end user groups and remove excessive module permissions for accounts that do not require them.
Review recent entries in tl_log to identify actions that may indicate exploitation of the flaw prior to patching.

Patch Information

Contao published the fix in commit 3f05c603e1c94d34819f837f060df5d66447d0d7, released in versions 5.3.38 and 5.6.1. See the Contao Security Advisory and GitHub Security Advisory GHSA-7m47-r75r-cx8v for full details.

Workarounds

Do not rely solely on the table access voter for authorization decisions; explicitly check the USER_CAN_ACCESS_MODULE permission in custom back-end code paths.
Restrict back-end access to trusted networks or VPN until upgrades are applied.
Reduce the attack surface by minimizing the number of back-end user accounts with partial module access.

bash

# Upgrade Contao core-bundle via Composer
composer require contao/core-bundle:^5.6.1 --update-with-dependencies
# Or for the 5.3 LTS branch
composer require contao/core-bundle:^5.3.38 --update-with-dependencies

# Clear cache after upgrade
php bin/console cache:clear --env=prod