{"id":"CVE-2026-116898","kind":"vulnerability","aliases":["CVE-2026-116898"],"related":[],"title":"REDAXO: media pool bulk move skips source category permission check","description":"REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.","summary":"REDAXO, a PHP content management system, has a missing authorization check in its media pool bulk move feature. An authenticated backend user with rights on one media category can move files out of restricted categories and overwrite their contents site-wide.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","other","php","redaxo","self-hosted"],"not_affected_if":["redaxo-5.21.4-or-later","single-media-category-permissions-not-used"],"how_to_check":"- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; the sources do not name a specific file.\n- Confirm whether backend users hold media pool permissions on only some categories.","fix":"- Upgrade REDAXO to `5.21.4` or later.","status":"open","published_at":"2026-10-27T11:17:32+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:49+00:00","updated_at":"2026-10-27T11:31:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T11:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO to `5.21.4` or later.","reach":"internet","title":"REDAXO: media pool bulk move skips source category permission check","impact":"medium","summary":"REDAXO, a PHP content management system, has a missing authorization check in its media pool bulk move feature. An authenticated backend user with rights on one media category can move files out of restricted categories and overwrite their contents site-wide.","category":"other","nicknames":[],"who_cares":["redaxo","php","cms","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user overwrites restricted media files across the whole site","analyst_note":"","how_to_check":"- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; the sources do not name a specific file.\n- Confirm whether backend users hold media pool permissions on only some categories.","needs_analyst":false,"not_affected_if":["redaxo-5.21.4-or-later","single-media-category-permissions-not-used"],"who_is_affected":"Sites running REDAXO before 5.21.4 where backend users have media pool permissions limited to certain categories. Sites with only full-access administrators, or without restricted media categories, have less exposure. Sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000573,"input_tokens":3311,"output_tokens":484,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116898':13A,16A '-2026':12A,15A '5.21.4':68C 'authent':43B,90C 'author':33B,72C 'backend':44B,91C 'bulk':4A,39B,78C 'categori':8A,51B,58B,84C,89C,98C,104C 'check':10A,34B,81C 'cms':17B 'contain':69C 'content':27B,62B,111C 'cve':11A,14A 'featur':41B 'file':54B,101C 'host':23B 'ignor':86C 'manag':28B 'media':2A,37B,50B,76C,97C 'miss':32B,71C 'move':5A,40B,53B,79C,100C 'one':49B,96C 'overwrit':60B 'permiss':9A,85C,94C 'php':19B,26B 'pool':3A,38B,77C 'redaxo':1A,20B,24B,66C 'replac':109C 'restrict':57B,103C 'right':47B 'self':22B 'self-host':21B 'silent':108C 'site':64B,113C 'site-wid':63B,112C 'skip':6A 'sourc':7A,88C 'system':29B 'target':83C 'user':45B,92C 'vulner':73C 'wide':65B,114C","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO before 5.21.4 where backend users have media pool permissions limited to certain categories. Sites with only full-access administrators, or without restricted media categories, have less exposure. Sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116898","severity":null,"published_at":"2026-10-27T11:17:32+00:00","modified_at":"2026-10-27T11:17:32+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}