CVE-2026-48956
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An improper access check in Contao allows unauthorized users to display a list of modules in the frontend.
Risk Assessment
The risk involves information disclosure about installed modules, which could help an attacker identify potential system weaknesses.
Recommendation
Immediately update Contao to the latest patched version and verify access control configurations.
Other vulnerabilities in Contao
See all- CVE-2017-10993High
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, known as Directory Traversal.
- CVE-2026-55825Low
Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.
- CVE-2026-57232Low
Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.
- CVE-2026-55824Low
Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.
Original NVD description (English source)
An improper access check allows users to display a list of modules in the frontend.