Presentation
The Contao back office offers a CSV import wizard used to populate form fields and other tabular data. Access to a record is normally decided by the permission voters attached to its data container.
HDW Sec found that the wizard is reachable through a key action that never re-checks ownership, so a back office user can overwrite records that the interface itself refuses to let them edit.
Issue(s)
- The record identifier is taken from the request and used directly, without an authorization check on the target (insecure direct object reference).
- The regular edit path correctly denies access to the record, which makes the gap easy to miss: the deny happens on one route and not on the other.
- Confirmed live end to end on a self-hosted lab: editing was denied through the interface, while the key action overwrote the record.
- The impact is on integrity: content belonging to another scope is overwritten, without needing to read it first.
References
- GitHub advisory: GHSA-23w9-4pg3-xwm3
- Fixed in Contao 5.3.50 and 5.7.12, published 2026-08-25. No CVE assigned as of publication.