Cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acontaocontao/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:55:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgContao: Access control bypass vulnerability in file manager (CVE-2026-126662)https://feed.craftedsignal.io/briefs/2026-11-contao-access-control-bypass-cve-2026-126662/Wed, 11 Nov 2026 13:55:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-contao-access-control-bypass-cve-2026-126662/Contao versions 4.x, 5.x, and 6.x contain an access control bypass vulnerability in the file manager allowing restricted users to manipulate folders outside their authorized scope.Contao versions 4.0.0 through 5.3.53, 5.4.0 through 5.7.16, and 6.0.0 through 6.0.5 contain an access control bypass vulnerability. The flaw exists in the file manager's "Edit-Multiple" operation. Authenticated backend users with filemount restrictions can exploit the "IDS" parameter to perform operations on folders outside their authorized filemount. This allows attackers to publish protected folders or exclude them from DBAFS synchronization, potentially exposing sensitive files for public download.

Impact

The vulnerability allows unauthorized access to sensitive files that should have been restricted by filemount permissions. Files exposed via this flaw may become accessible for public download.

Recommendation

  • Update Contao instances to the following patched versions: 5.3.54, 5.7.17, or 6.0.6.
  • Restrict backend access to trusted users and conduct an audit of current filemount permissions.
  • Monitor backend file manager activity for anomalous requests involving the "IDS" parameter during "Edit-Multiple" operations.
]]>highadvisory