Threats tagged 'ghsa-hwq6-xx43-jmg7'

Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 have an access control bypass vulnerability. This flaw allows backend users restricted by filemount permissions to modify folders outside their allowed scope via the file manager's Edit-Multiple operation. Attackers with specific permissions can manipulate folder paths to expose protected files publicly or exclude them from synchronization, risking unauthorized file access.