CVE-2026-126662

Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 5.3.53 Contao versions 5.4.0 through 5.7.16 Contao versions 6.0.0 through 6.0.5

Description An access control bypass exists in the file manager Edit-Multiple operation. Backend users with filemount restrictions can modify folders outside their assigned filemount if they possess the protected or syncExclude field permissions. By submitting external folder paths through the IDS parameter, an attacker can publish protected folders or exclude them from DBAFS synchronization, which may lead to files being exposed for public download.

Recommendations Update Contao versions 4.0.0 through 5.3.53 to version 5.3.54. Update Contao versions 5.4.0 through 5.7.16 to version 5.7.17. Update Contao versions 6.0.0 through 6.0.5 to version 6.0.6.