Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-116897

REDAXO before 5.21.4 Missing Authorization in Version and History Previews

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

redaxo core

Default version status: unaffected

  • 0 to < 5.21.4affected
  • 5.21.4unaffected

References