Description
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Form Integrated With Google Maps Cross-Site Scripting (2.4)
RubyGems Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2018-1000075)
WordPress Plugin Activity Log Multiple Cross-Site Scripting Vulnerabilities (2.4.0)
Oracle JRE CVE-2013-5784 Vulnerability (CVE-2013-5784)
Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-4043)