Live › vulnerability › CVE-2026-116897
Go to dashboardREDAXO core before 5.21.4 fails to check category or language permissions in its structure/version and structure/history preview modes. A backend user, or a user holding the history[article_rollback] permission, can read unpublished working versions and historic or deleted article content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO core before 5.21.4 with backend accounts, especially where some editors have restricted category or language rights or the history rollback permission. Sites with no backend users beyond trusted administrators have little exposure. The sources do not say whether the frontend preview modes are enabled by default.
No product ranges from the sources yet.
redaxo/src/core/boot.php for the version constant5.21.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
This page as .md · .json · in your agent: get_signal("CVE-2026-116897")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.