Contao: Access control bypass vulnerability in file manager (CVE-2026-126662)
Contao versions 4.x, 5.x, and 6.x contain an access control bypass vulnerability in the file manager allowing restricted users to manipulate folders outside their authorized scope.
CVE search metadata
CVE search record: CVE-2026-126662. Severity: high. CVSS: 7.1. KEV: no. Product: Contao (4.0.0 < 5.3.54, 5.4.0 < 5.7.17, 6.0.0 < 6.0.6). Brief: Contao: Access control bypass vulnerability in file manager (CVE-2026-126662). Brief link: https://feed.craftedsignal.io/briefs/2026-11-contao-access-control-bypass-cve-2026-126662/
Triage facts
Revision 1- Applicability
- Contao (4.0.0 < 5.3.54, 5.4.0 < 5.7.17, 6.0.0 < 6.0.6)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Contao versions 4.0.0 through 5.3.53, 5.4.0 through 5.7.16, and 6.0.0 through 6.0.5 contain an access control bypass vulnerability. The flaw exists in the file manager's "Edit-Multiple" operation. Authenticated backend users with filemount restrictions can exploit the "IDS" parameter to perform operations on folders outside their authorized filemount. This allows attackers to publish protected folders or exclude them from DBAFS synchronization, potentially exposing sensitive files for public download.
Impact
The vulnerability allows unauthorized access to sensitive files that should have been restricted by filemount permissions. Files exposed via this flaw may become accessible for public download.
Recommendation
- Update Contao instances to the following patched versions: 5.3.54, 5.7.17, or 6.0.6.
- Restrict backend access to trusted users and conduct an audit of current filemount permissions.
- Monitor backend file manager activity for anomalous requests involving the "IDS" parameter during "Edit-Multiple" operations.
Immediate actions
Upgrade Contao to version 5.3.54, 5.7.17, or 6.0.6
Threat Hunt
Inspect web server logs for POST requests to the Contao backend file manager Edit-Multiple controller where the IDS parameter contains path traversal sequences or directory paths outside assigned mounts.
Data: Web server access logs
Mitigations
Apply security patches or limit access to backend file management features
CVE-2026-126662