| Package | Affected versions | Patched versions |
|---|---|---|
| contao/contao | ≥ 4.0.0, < 4.4.46≥ 4.5.0, < 4.8.6 | 4.4.464.8.6 |
| contao/core-bundle | ≥ 4.0.0, < 4.4.46≥ 4.5.0, < 4.8.6 | 4.4.464.8.6 |
| contao | = 4.0= 4.1= 4.2= 4.3= 4.5= 4.6= 4.7≥ 4.4.0, ≤ 4.4.45≥ 4.8, ≤ 4.8.5 |
Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
Update to Contao 4.4.46 or 4.8.6.
None.
https://contao.org/en/security-advisories/information-disclosure-in-the-back-end
If you have any questions or comments about this advisory, open an issue in contao/contao.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free