CVE-2026-116897: REDAXO before 5.21.4 Missing Authorization in Version and History Previews

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-27
Weakness: CWE-862

Description

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.

Affected products

redaxo core: before 5.21.4 — fixed in 5.21.4

How to fix

Upgrade to a fixed version: redaxo core 5.21.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-116897 or the next vulnerability affects your stack