CVE-2025-57758
Last modified
CVE-2025-57758 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Contao | Contao | >= 5.3.0, < 5.3.38 |
| Contao | Contao | >= 5.4.0, < 5.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-57758?
How severe is CVE-2025-57758?
How do I fix CVE-2025-57758?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-57752Next.js is a React framework for building full-stack web app…6.2
- CVE-2025-57753vite-plugin-static-copy is rollup-plugin-copy for Vite with …6
- CVE-2025-57754eslint-ban-moment is an Eslint plugin for final assignment i…9.8
- CVE-2025-57755claude-code-router is a powerful tool to route Claude Code r…8.1
- CVE-2025-57756Contao is an Open Source CMS. In versions starting from 4.9.…5.3
- CVE-2025-57757Contao is an Open Source CMS. In versions starting from 5.0.…5.3
- CVE-2025-57759Contao is an Open Source CMS. In versions starting from 5.3.…4.3
- CVE-2025-57760Langflow is a tool for building and deploying AI-powered age…8.8
- CVE-2025-57761WeGIA is a Web manager for charitable institutions. Prior to…8.8
- CVE-2025-57762WeGIA is a Web manager for charitable institutions. Prior to…6.1
- CVE-2025-57763WeGIA is a Web manager for charitable institutions. Prior to…6.1
- CVE-2025-57764WeGIA is a Web manager for charitable institutions. Prior to…8.2
Are you affected by CVE-2025-57758?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST