CVE-2021-37627 json
Privilege escalation via form generator
published 2021-08-11 5 y ago modified 2026-07-08 4 mo ago also GHSA-hq5m-mqmx-fw6m , EUVD-2021-1752
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form generator or disable the login for untrusted back end users.
Patch / fix
- packagist contao/core-bundle 4.4.56, 4.9.18, 4.11.7
- packagist contao/contao 4.4.56, 4.9.18, 4.11.7
- contao contao 4.4.56, 4.9.18, 4.11.7
Exploit prediction
1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | contao/core-bundle | >=4.0.0, <4.4.56 >=4.5.0, <4.9.18 >=4.10.0, <4.11.7 |
4.4.56 4.9.18 4.11.7 |
| packagist | contao/contao | >=4.0.0, <4.4.56 >=4.5.0, <4.9.18 >=4.10.0, <4.11.7 |
4.4.56 4.9.18 4.11.7 |
Affected products
- contao contao
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
contao.org
/en/security-advisories/privilege-escalation-with-the-form-generator.html
web, vendor-advisory
-
github.com
/contao/contao/security/advisories/GHSA-hq5m-mqmx-fw6m
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-37627
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2021-37627.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2021-37627.yaml
web
-
github.com
/contao/contao
package
Sources
- CVE List CVE-2021-37627
- GitHub Advisory GHSA-hq5m-mqmx-fw6m
- NVD CVE-2021-37627
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.