CVE-2026-116897GHSA-v4m9-jvvr-83cx
core: REDAXO before 5.21.4 Missing Authorization in Version and History Previews
redaxo core
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.21.4coreCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
Text from CVE List
Affected versions 2
- coreaffected: all versions before 5.21.4CVE List
- coreunaffected: 5.21.4CVE List