Live › vulnerability › CVE-2026-117532
Go to dashboardREDAXO core versions from 5.3.0 before 5.21.4 have an authentication bypass in the structure/history plugin. An unauthenticated attacker can forge temporary login tokens for accounts such as admin, which gives backend access and code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
REDAXO installations running core from 5.3.0 up to but not including 5.21.4 with the structure/history plugin present are exposed. Sites that have already upgraded to 5.21.4 or later are not affected; the sources do not say whether the plugin is off by default.
No product ranges from the sources yet.
redaxo/src/core/boot.php; unknown if the sources give another location5.21.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.
This page as .md · .json · in your agent: get_signal("CVE-2026-117532")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.