{"id":"CVE-2026-116897","kind":"vulnerability","aliases":["CVE-2026-116897"],"related":[],"title":"REDAXO CMS: preview modes let backend users read unpublished content","description":"REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.","summary":"REDAXO core before 5.21.4 fails to check category or language permissions in its structure/version and structure/history preview modes. A backend user, or a user holding the history[article_rollback] permission, can read unpublished working versions and historic or deleted article content.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","redaxo","self-hosted"],"not_affected_if":["already-on-5.21.4","no-backend-users-besides-admins"],"how_to_check":"- Check the installed REDAXO core version in the backend or `redaxo/src/core/boot.php` for the version constant\n- Confirm whether untrusted or low-privilege backend users exist, since the flaw needs a backend account\n- unknown for any other check","fix":"- Upgrade REDAXO core to `5.21.4` or later\n- unknown for any workaround in the sources","status":"open","published_at":"2026-10-27T11:17:32+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:50+00:00","updated_at":"2026-10-27T11:31:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO core to `5.21.4` or later\n- unknown for any workaround in the sources","reach":"network","title":"REDAXO CMS: preview modes let backend users read unpublished content","impact":"medium","summary":"REDAXO core before 5.21.4 fails to check category or language permissions in its structure/version and structure/history preview modes. A backend user, or a user holding the history[article_rollback] permission, can read unpublished working versions and historic or deleted article content.","category":"package","nicknames":[],"who_cares":["redaxo","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"backend user reads unpublished and deleted article content","analyst_note":"","how_to_check":"- Check the installed REDAXO core version in the backend or `redaxo/src/core/boot.php` for the version constant\n- Confirm whether untrusted or low-privilege backend users exist, since the flaw needs a backend account\n- unknown for any other check","needs_analyst":false,"not_affected_if":["no-backend-users-besides-admins","already-on-5.21.4"],"who_is_affected":"Sites running REDAXO core before 5.21.4 with backend accounts, especially where some editors have restricted category or language rights or the history rollback permission. Sites with no backend users beyond trusted administrators have little exposure. The sources do not say whether the frontend preview modes are enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0006,"input_tokens":3337,"output_tokens":533,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116897':13A,16A '-2026':12A,15A '5.21.4':27B,68C 'arbitrari':112C 'articl':51B,63B,93C,101C,113C 'author':72C 'backend':6A,43B,95C 'categori':31B,86C 'check':30B,85C 'clang':88C 'cms':2A,17B 'contain':69C 'content':10A,64B,125C 'core':25B,66C 'cve':11A,14A 'date':110C 'delet':62B,124C 'fail':28B 'frontend':79C 'histor':60B,122C 'histori':50B,100C,109C 'hold':48B,99C 'host':23B 'id':114C 'languag':33B 'let':5A 'miss':71C 'mode':4A,41B,81C 'one':98C 'packag':18B 'permiss':34B,53B,89C 'php':19B 'preview':3A,40B,80C,92C 'read':8A,55B,117C 'redaxo':1A,20B,24B,65C 'rex':105C,108C 'rollback':52B,102C 'self':22B 'self-host':21B 'set':104C 'structure/history':39B,78C 'structure/version':37B,76C 'unpublish':9A,56B,118C 'user':7A,44B,47B,96C 'valu':115C 'version':58B,106C,120C 'vulner':73C 'work':57B,119C","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO core before 5.21.4 with backend accounts, especially where some editors have restricted category or language rights or the history rollback permission. Sites with no backend users beyond trusted administrators have little exposure. The sources do not say whether the frontend preview modes are enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116897","severity":null,"published_at":"2026-10-27T11:17:32+00:00","modified_at":"2026-10-27T11:17:32+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}