{"id":"CVE-2026-126318","kind":"vulnerability","aliases":["CVE-2026-126318"],"related":[],"title":"REDAXO CMS: editors can change live articles without approval permission","description":"REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.","summary":"REDAXO versions before 5.21.6 let an editor without the live-version permission change live article content by going around the working-version approval step. An attacker with a normal editor account can add, edit, delete, or reorder live content blocks, bypassing the approval workflow.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","redaxo","self-hosted"],"not_affected_if":["auth-required","single-editor"],"how_to_check":"- Check the installed REDAXO version in the project's `redaxo/src/core/boot.php` or the admin System page; versions below `5.21.6` are affected.\n- Review which backend users hold the editor role without the `version[live_version]` permission.","fix":"- REDAXO: upgrade to `5.21.6`","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:57:25+00:00","updated_at":"2026-11-13T10:57:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:57:25Z","model":"claude-haiku-5-5","output":{"fix":"- REDAXO: upgrade to `5.21.6`","reach":"network","title":"REDAXO CMS: editors can change live articles without approval permission","impact":"medium","summary":"REDAXO versions before 5.21.6 let an editor without the live-version permission change live article content by going around the working-version approval step. An attacker with a normal editor account can add, edit, delete, or reorder live content blocks, bypassing the approval workflow.","audience":"businesses","category":"package","nicknames":[],"who_cares":["redaxo","php","self-hosted","cms"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"editor alters live published article content without approval","analyst_note":"","how_to_check":"- Check the installed REDAXO version in the project's `redaxo/src/core/boot.php` or the admin System page; versions below `5.21.6` are affected.\n- Review which backend users hold the editor role without the `version[live_version]` permission.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-editor","auth-required"],"who_is_affected":"Sites running REDAXO CMS before 5.21.6 with multiple backend editors, where some editors lack the live-version permission. Sites with a single trusted editor or with approval workflows not used are less exposed; the sources do not describe a non-authenticated path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4623,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126318':13A,16A '-2026':12A,15A '5.21.6':27B,72C 'account':56B 'add':58B,100C 'allow':79C 'approv':9A,48B,68B,124C 'around':43B 'articl':7A,39B,90C 'attack':51B 'authent':97C 'author':75C 'block':65B 'bypass':66B,76C,93C,123C 'chang':5A,37B 'cms':2A,17B 'contain':73C 'content':40B,64B,112C,115C,121C 'content/functions':109C 'copi':122C 'cve':11A,14A 'delet':60B,102C 'edit':59B,101C 'editor':3A,30B,55B,80C,98C 'enforc':96C 'go':42B 'histori':118C 'host':23B 'id':111C 'let':28B 'live':6A,34B,38B,63B,84C,89C,106C 'live-vers':33B 'modifi':88C 'move':116C 'normal':54B 'packag':18B 'permiss':10A,36B,86C 'php':19B 'redaxo':1A,20B,24B,70C 'reorder':62B,105C 'restor':119C 'self':22B 'self-host':21B 'slice':107C,110C,113C,117C 'status':114C 'step':49B 'toggl':103C 'version':25B,35B,47B,83C,85C,91C,95C 'via':108C 'vulner':77C 'without':8A,31B,81C 'work':46B,94C 'workflow':69B,125C 'working-vers':45B","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO CMS before 5.21.6 with multiple backend editors, where some editors lack the live-version permission. Sites with a single trusted editor or with approval workflows not used are less exposed; the sources do not describe a non-authenticated path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","package","php","redaxo","selfhosted"],"campaign_type":null,"search_a":"'-126318':13A,16A '-2026':12A,15A 'approv':9A 'articl':7A 'chang':5A 'cms':2A 'cve':11A,14A 'editor':3A 'live':6A 'permiss':10A 'redaxo':1A 'without':8A","search_b":"'5.21.6':27B 'account':56B 'add':58B 'approv':48B,68B 'around':43B 'articl':39B 'attack':51B 'block':65B 'bypass':66B 'chang':37B 'cms':17B 'content':40B,64B 'delet':60B 'edit':59B 'editor':30B,55B 'go':42B 'host':23B 'let':28B 'live':34B,38B,63B 'live-vers':33B 'normal':54B 'packag':18B 'permiss':36B 'php':19B 'redaxo':20B,24B 'reorder':62B 'self':22B 'self-host':21B 'step':49B 'version':25B,35B,47B 'without':31B 'work':46B 'workflow':69B 'working-vers':45B","search_c":"'5.21.6':72C 'add':100C 'allow':79C 'approv':124C 'articl':90C 'authent':97C 'author':75C 'bypass':76C,93C,123C 'contain':73C 'content':112C,115C,121C 'content/functions':109C 'copi':122C 'delet':102C 'edit':101C 'editor':80C,98C 'enforc':96C 'histori':118C 'id':111C 'live':84C,89C,106C 'modifi':88C 'move':116C 'permiss':86C 'redaxo':70C 'reorder':105C 'restor':119C 'slice':107C,110C,113C,117C 'status':114C 'toggl':103C 'version':83C,85C,91C,95C 'via':108C 'vulner':77C 'without':81C 'work':94C 'workflow':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-25T10:46:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126318","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144967,"url":"https://github.com/redaxo/core/security/advisories/GHSA-6w5f-mr8f-5964","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-25T10:46:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144968,"url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.6-authorization-bypass-of-live-version-permission","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}