Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-f1az-1ejn-53f7
Vulnerability ID VCID-f1az-1ejn-53f7
Aliases CVE-2025-57756
GHSA-2xmj-8wmq-7475
Summary Contao discloses sensitive information in the front end search index Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-612 Improper Authorization of Index Containing Sensitive Information
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.3 https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
generic_textual MODERATE https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
cvssv3.1 5.3 https://github.com/contao/contao
generic_textual MODERATE https://github.com/contao/contao
cvssv3.1 5.3 https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
generic_textual MODERATE https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
cvssv3.1 5.3 https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
generic_textual MODERATE https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-57756
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-57756
Reference id Reference type URL
https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
https://github.com/contao/contao
https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
CVE-2025-57756 https://nvd.nist.gov/vuln/detail/CVE-2025-57756
GHSA-2xmj-8wmq-7475 https://github.com/advisories/GHSA-2xmj-8wmq-7475
GHSA-2xmj-8wmq-7475 https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-57756
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-04T16:24:53.796052+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/contao/core-bundle/CVE-2025-57756.yml 38.6.0