Is CVE-2026-126662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126662 being exploited in the wild.

How severe is CVE-2026-126662?

High severity, with a CVSS score of 7.1, published 11 November 2026.

Which products and versions are affected?

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, 6.0.0 before 6.0.6.

Is there a fix for CVE-2026-126662?

Yes: fixed in 5.3.54, 5.7.17, 6.0.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126662 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-126662?

Check whether you run Contao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126662: Contao access control bypass in file manager Edit-Multiple

CVE-2026-126662 · Severity: high · CVSS 7.1 · Published 2026-11-11

Contao is a web content management system used to build and manage websites. A vulnerability in the file manager allows backend users with restricted file access to edit folders outside their assigned boundaries through a multi-edit operation, potentially exposing protected files for public download or excluding them from security backups.

Technologies: Contao. Vendors: Contao.

Quick answers

Is CVE-2026-126662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126662 being exploited in the wild.
How severe is CVE-2026-126662?: High severity, with a CVSS score of 7.1, published 11 November 2026.
Which products and versions are affected?: Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, 6.0.0 before 6.0.6.
Is there a fix for CVE-2026-126662?: Yes: fixed in 5.3.54, 5.7.17, 6.0.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126662 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-126662?: Check whether you run Contao at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.3.54, 5.7.17, 6.0.6

Technical details

An access control bypass in the DC_Folder.php driver's editAll() method fails to validate whether folders passed in the IDS parameter are within a user's filemount restrictions. Authenticated backend users with protected or syncExclude field permissions can submit out-of-bounds folder paths to modify protected folder status or DBAFS sync exclusions, bypassing filemount access controls.

Affected products

Contao Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, 6.0.0 before 6.0.6

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.