---
id: "CVE-2026-116899"
kind: "vulnerability"
aliases: ["CVE-2026-116899"]
title: "REDAXO CMS: authenticated editors can alter slices in other categories"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cms", "php", "redaxo", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "single-editor"]
published_at: "2026-10-27T11:17:32+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:31:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116899", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# REDAXO CMS: authenticated editors can alter slices in other categories

REDAXO before 5.21.4 checks article permissions but not the slice ID paired with it, so an editor can pair an article they may edit with a slice from a category they may not. An attacker with an editor account can then delete, toggle, move or overwrite other editors' slices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the project's `redaxo/src/core/boot.php` or the version shown in the backend; versions below `5.21.4` are affected.
- Confirm whether editor-role accounts exist in the backend under Users.

## Fix

- Upgrade REDAXO to `5.21.4` or later.
- Until upgraded, limit editor-role accounts to trusted staff.

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116899

## From the sources

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_