Live › vulnerability › CVE-2026-116896
Go to dashboardThe REDAXO backup addon lets users with the backup[export] permission export any database table, including rex_user and rex_user_session. An attacker with that permission can read plaintext session IDs to take over admin accounts, or password hashes to crack offline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO before 5.21.5 with the backup addon installed and at least one non-admin user or role granted the backup[export] permission. Sites without the backup addon or with no non-admin users holding that permission are less exposed. unknown whether the sources list any further conditions.
No product ranges from the sources yet.
redaxo/src/core/boot.php or the version shown in the backend) and confirm whether it is below 5.21.5.backup[export] permission in the backend user/role settings.5.21.5 or later.backup[export] permission from non-admin roles.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
This page as .md · .json · in your agent: get_signal("CVE-2026-116896")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.