Access Control Bypass in Contao Products by Contao

CVE-2026-126662

What is CVE-2026-126662?

The Contao content management system versions prior to 5.3.54, 5.7.17, and 6.0.6 are susceptible to an access control bypass vulnerability. This flaw permits users with filemount restrictions to circumvent access controls through the file manager’s Edit-Multiple operation. Attackers who possess permissions such as protected or syncExclude can exploit this vulnerability by injecting unauthorized folder paths, potentially making sensitive files publicly accessible or excluding them from necessary database synchronization. It is crucial for users to apply available updates to safeguard against this exploit.

References