CVE-2025-57759: Contao CMS Privilege Escalation Vulnerability

CVE-2025-57759 Overview

Contao is an open source content management system (CMS) used to build and manage websites. CVE-2025-57759 is an improper privilege management vulnerability [CWE-269] affecting Contao versions from 5.3.0 through versions prior to 5.3.38 and 5.6.1. Under certain conditions, authenticated back end users can edit fields of pages and articles without holding the required permissions. The maintainers patched the issue in versions 5.3.38 and 5.6.1. No workarounds are available.

Critical Impact
Authenticated back end users can modify page and article fields outside their assigned permission scope, enabling unauthorized content changes across a Contao site.

Affected Products

Contao CMS versions 5.3.0 through 5.3.37
Contao CMS versions 5.4.0 through 5.6.0
Fixed in Contao 5.3.38 and 5.6.1

Discovery Timeline

2025-08-28 - CVE-2025-57759 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-57759

Vulnerability Analysis

The flaw resides in the Contao back end data container access-control logic. Field-level edit operations for pages and articles did not consistently invoke the permission voter, allowing authenticated back end users to write to fields their role should not control. Because the check depended on how the record was accessed within DataContainerOperation, callers that bypassed the getter could evade the permission decision entirely.

The patch refactors record access to route through DataContainerOperation::getRecord() and reworks the ArticleContentVoter to maintain a structured pageMap (id and type) rather than a flat list of pageIds. This ensures the voter has the context needed to correctly evaluate permissions for article content tied to specific page types.

Root Cause

The root cause is improper privilege management [CWE-269] in the data container operation handling. Access decisions relied on raw array access to the record, and the article content voter lacked page-type context, producing inconsistent authorization results for field edits.

Attack Vector

Exploitation requires network access to the Contao back end and valid low-privilege credentials. No user interaction is required. A malicious back end user can craft edit requests against page or article fields they do not own or lack permission to modify, altering site content or configuration data within scope of a normal back end session.

php

// Patch excerpt: core-bundle/src/EventListener/DataContainer/DefaultOperationsListener.php
    private function toggleCallback(string $table, string $toggleField): \Closure
    {
        return function (DataContainerOperation $operation) use ($toggleField, $table): void {
-            $new = [$toggleField => !($operation['record'][$toggleField] ?? false)];
+            $new = [$toggleField => !($operation->getRecord()[$toggleField] ?? false)];

            if (!$this->isGranted(UpdateAction::class, $table, $operation, $new)) {
                // Do not use DataContainerOperation::disable() because it would not show the

Source: Contao commit 80ee7db

php

// Patch excerpt: core-bundle/src/Security/Voter/DataContainer/ArticleContentVoter.php
 class ArticleContentVoter extends AbstractDynamicPtableVoter
 {
-    private array $pageIds = [];
+    /**
+     * @var array<int, array{id: int, type: string}>
+     */
+    private array $pageMap = [];

     public function __construct(
         private readonly AccessDecisionManagerInterface $accessDecisionManager,

Source: Contao commit 80ee7db

Detection Methods for CVE-2025-57759

Indicators of Compromise

Back end audit log entries showing edits to tl_page or tl_article fields performed by users whose role should not permit those changes.
Unexpected POST requests to /contao?do=article or /contao?do=page endpoints from low-privilege accounts.
Content or configuration drift on pages and articles without a corresponding change ticket or authorized editor.

Detection Strategies

Review Contao back end user permissions and correlate them against recent edit history in the tl_log table.
Enable Contao's built-in logging for back end activity and forward logs to a centralized SIEM for permission-anomaly analysis.
Compare current Contao core version against 5.3.38 and 5.6.1 to identify vulnerable deployments.

Monitoring Recommendations

Alert on back end write operations to page or article records executed by non-administrator user groups.
Monitor HTTP access logs for repeated authenticated requests to Contao data container edit routes.
Track deployment inventories to flag Contao installations that remain on affected versions.

How to Mitigate CVE-2025-57759

Immediate Actions Required

Upgrade Contao to version 5.3.38 (for the 5.3.x branch) or 5.6.1 (for the 5.6.x branch) without delay.
Audit all back end user accounts and remove unnecessary edit permissions on pages and articles.
Review recent changes to tl_page and tl_article records for unauthorized modifications performed by low-privilege users.

Patch Information

Contao released fixes in versions 5.3.38 and 5.6.1. The remediation is delivered in commit 80ee7db12d55ad979d9b1b180f273d4e2668851f. See the Contao Security Advisory and GHSA-qqfq-7cpp-hcqj for the official disclosure.

Workarounds

No workarounds are provided by the vendor; upgrading is the only supported remediation.
As an interim compensating control, restrict back end access to trusted administrators only until the patch is applied.

bash

# Upgrade Contao via Composer to a fixed version
composer require contao/core-bundle:^5.6.1 --update-with-dependencies
# Or, for the 5.3.x maintenance branch
composer require contao/core-bundle:^5.3.38 --update-with-dependencies

# Clear caches after upgrade
php bin/console cache:clear --env=prod
php bin/console contao:migrate