UpHeron
All vulnerabilities

Servers and applications

CVE-2021-37627

Privilege escalation with the form generator

Severity
High 7.2
Published
11 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.4.56, 4.9.18, 4.11.7
Also known as
GHSA-hq5m-mqmx-fw6m
Sources
NVD, Project advisories (GitHub)

Description

Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form…

Affected software

SoftwareAffected versions
ContaoServers and applications · cpe:a:contao:contao
  • From 4.11.0 before 4.11.7
  • Version 4.10.0
  • From 4.9.0 before 4.9.18
  • Version 4.8.0
All 12 release lines
  • Version 4.0.0
  • Version 4.1.0
  • Version 4.2.0
  • Version 4.3.0
  • From 4.4.0 before 4.4.56
  • Version 4.5.0
  • Version 4.6.0
  • Version 4.7.0
  • Version 4.8.0
  • From 4.9.0 before 4.9.18
  • Version 4.10.0
  • From 4.11.0 before 4.11.7
ContaoServers and applications · github:contao/contao
  • Every version before 4.4.56

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-37627
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-37627
  • GitHub Advisory Database https://github.com/advisories/GHSA-hq5m-mqmx-fw6m
  • github.com https://github.com/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6m