CVE-2026-126318 · Package
NO FIX YET · SEE WHAT TO DO
REDAXO versions before 5.21.6 let an editor without the live-version permission change live article content by going around the working-version approval step. An attacker with a normal editor account can add, edit, delete, or reorder live content blocks, bypassing the approval workflow.
first public Oct 25, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running REDAXO CMS before 5.21.6 with multiple backend editors, where some editors lack the live-version permission. Sites with a single trusted editor or with approval workflows not used are less exposed; the sources do not describe a non-authenticated path.
Not affected if auth-required, single-editor
Who cares cms, php, redaxo, self-hosted
redaxo/src/core/boot.php or the admin System page; versions below 5.21.6 are affected.version[live_version] permission.5.21.6REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.