Contao: Improper access control in the table access voter

Medium · CVSS 4.3

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This includes tables containing sensitive personal data, such as frontend member records and newsletter subscriber e-mail addresses. ### Vulnerability Details In plain terms: Contao's backend is organized into modules (e.g. "News", "Members").

Remediation

Upgrade contao/core-bundle to 5.7.12 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-5974-gfqc-wrcm

← All threats