Live › vulnerability › CVE-2026-116899
Go to dashboardREDAXO before 5.21.4 checks article permissions but not the slice ID paired with it, so an editor can pair an article they may edit with a slice from a category they may not. An attacker with an editor account can then delete, toggle, move or overwrite other editors' slices.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO before 5.21.4 with more than one editor account that have access to different categories. A single-editor site or one where all editors share full category rights is less exposed, though the flaw still exists. Public visitors without a backend account cannot use it.
No product ranges from the sources yet.
redaxo/src/core/boot.php or the version shown in the backend; versions below 5.21.4 are affected.5.21.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.
This page as .md · .json · in your agent: get_signal("CVE-2026-116899")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.