---
id: "CVE-2026-116898"
kind: "vulnerability"
aliases: ["CVE-2026-116898"]
title: "REDAXO: media pool bulk move skips source category permission check"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "other", "php", "redaxo", "self-hosted"]
not_affected_if: ["redaxo-5.21.4-or-later", "single-media-category-permissions-not-used"]
published_at: "2026-10-27T11:17:32+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:31:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116898", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# REDAXO: media pool bulk move skips source category permission check

REDAXO, a PHP content management system, has a missing authorization check in its media pool bulk move feature. An authenticated backend user with rights on one media category can move files out of restricted categories and overwrite their contents site-wide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; the sources do not name a specific file.
- Confirm whether backend users hold media pool permissions on only some categories.

## Fix

- Upgrade REDAXO to `5.21.4` or later.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116898

## From the sources

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_