Live › vulnerability › CVE-2026-116898
Go to dashboardREDAXO, a PHP content management system, has a missing authorization check in its media pool bulk move feature. An authenticated backend user with rights on one media category can move files out of restricted categories and overwrite their contents site-wide.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO before 5.21.4 where backend users have media pool permissions limited to certain categories. Sites with only full-access administrators, or without restricted media categories, have less exposure. Sources do not say more.
No product ranges from the sources yet.
redaxo/src/core/boot.php version constant; the sources do not name a specific file.5.21.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
This page as .md · .json · in your agent: get_signal("CVE-2026-116898")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.