---
id: "CVE-2026-116897"
kind: "vulnerability"
aliases: ["CVE-2026-116897"]
title: "REDAXO CMS: preview modes let backend users read unpublished content"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "php", "redaxo", "self-hosted"]
not_affected_if: ["already-on-5.21.4", "no-backend-users-besides-admins"]
published_at: "2026-10-27T11:17:32+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:31:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116897", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# REDAXO CMS: preview modes let backend users read unpublished content

REDAXO core before 5.21.4 fails to check category or language permissions in its structure/version and structure/history preview modes. A backend user, or a user holding the history[article_rollback] permission, can read unpublished working versions and historic or deleted article content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO core version in the backend or `redaxo/src/core/boot.php` for the version constant
- Confirm whether untrusted or low-privilege backend users exist, since the flaw needs a backend account
- unknown for any other check

## Fix

- Upgrade REDAXO core to `5.21.4` or later
- unknown for any workaround in the sources

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116897

## From the sources

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_