Medium
Security advisory
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-19712
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:11 UTC · Revision 1
Source evidence
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
osv:CVE-2019-19712
Complete source record
{
"id": "e0a798715a4f2aac236749ff732ce34604463cc6f287ebc690c5cbdcc4359427",
"url": "https://osv.dev/vulnerability/CVE-2019-19712",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-19712",
"summary": "Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.",
"evidence": "osv:CVE-2019-19712",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-19712",
"aliases": [
"CVE-2019-19712",
"GHSA-4mvc-qc5w-v5qr"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/contao/contao",
"type": "GIT",
"events": [
{
"introduced": "da8a867d8335c4ca55e5085dac11f1fecd12650e"
},
{
"last_affected": "0dae4caadb79f1581d1851d849955929318bc7d9"
},
{
"introduced": "879e05ecc75a6bf70aabc1c3d867eb420f291f60"
},
{
"last_affected": "e2234567e8a17ff151137c288b14591213652195"
},
{
"introduced": "84b2fe637d5ead531f117f26b48d1b9de8df4074"
},
{
"last_affected": "b4dda036c2c0fc7d17c1aa402eaacf6b5dc335fc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4.0"
},
{
"last_affected": "4.4.45"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.8"
},
{
"last_affected": "4.8.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0"
},
{
"last_affected": "4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1"
},
{
"last_affected": "4.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.3"
},
{
"last_affected": "4.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.5"
},
{
"last_affected": "4.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.6"
},
{
"last_affected": "4.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:contao:contao:4.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.0",
"4.1",
"4.2",
"4.3",
"4.5",
"4.6",
"4.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19712.json"
}
}
],
"modified": "2026-10-24T10:31:04.051057256Z",
"provider": "osv",
"references": [
"https://contao.org/en/news.html",
"https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-19712",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440416,
"published_at": "2019-12-17T14:15:18.153+00:00"
}