{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contao-4.0.0--5.3.54-5.4.0--5.7.17-6.0.0--6.0.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-126662"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contao (4.0.0 \u003c 5.3.54, 5.4.0 \u003c 5.7.17, 6.0.0 \u003c 6.0.6)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Contao"],"content_html":"\u003cp\u003eContao versions 4.0.0 through 5.3.53, 5.4.0 through 5.7.16, and 6.0.0 through 6.0.5 contain an access control bypass vulnerability. The flaw exists in the file manager's \u0026quot;Edit-Multiple\u0026quot; operation. Authenticated backend users with filemount restrictions can exploit the \u0026quot;IDS\u0026quot; parameter to perform operations on folders outside their authorized filemount. This allows attackers to publish protected folders or exclude them from DBAFS synchronization, potentially exposing sensitive files for public download.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized access to sensitive files that should have been restricted by filemount permissions. Files exposed via this flaw may become accessible for public download.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Contao instances to the following patched versions: 5.3.54, 5.7.17, or 6.0.6.\u003c/li\u003e\n\u003cli\u003eRestrict backend access to trusted users and conduct an audit of current filemount permissions.\u003c/li\u003e\n\u003cli\u003eMonitor backend file manager activity for anomalous requests involving the \u0026quot;IDS\u0026quot; parameter during \u0026quot;Edit-Multiple\u0026quot; operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:55:41Z","date_published":"2026-11-11T13:55:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-contao-access-control-bypass-cve-2026-126662/","summary":"Contao versions 4.x, 5.x, and 6.x contain an access control bypass vulnerability in the file manager allowing restricted users to manipulate folders outside their authorized scope.","title":"Contao: Access control bypass vulnerability in file manager (CVE-2026-126662)","url":"https://feed.craftedsignal.io/briefs/2026-11-contao-access-control-bypass-cve-2026-126662/"}],"language":"en","title":"CraftedSignal Threat Feed - Contao (4.0.0 \u003c 5.3.54, 5.4.0 \u003c 5.7.17, 6.0.0 \u003c 6.0.6)","version":"https://jsonfeed.org/version/1.1"}