CVE-2026-116897
Received Received - Intake

REDAXO Core Missing Authorization in Preview Modes

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116897
EUVD
EUVD-2026-110793

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redaxo core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116897 is a missing authorization vulnerability in REDAXO core versions before 5.21.4. It affects the structure/version and structure/history frontend preview modes, which fail to check category or clang permissions for previewed articles. Any backend user or one with history[article_rollback] privilege can manipulate rex_version or rex_history_date parameters to access unpublished, historic, or deleted content.

Detection Guidance

Check for unauthorized access to unpublished content via frontend requests using parameters rex_version or rex_history_date in the structure/version and structure/history plugins. Monitor backend logs for suspicious article_id values in these parameters.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive content such as unpublished drafts, historical versions, or deleted articles. Attackers with minimal backend access could systematically expose confidential information without detection.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information. Unauthorized access to unpublished or deleted content may violate confidentiality requirements and data integrity principles.

Mitigation Strategies

Upgrade REDAXO core to version 5.21.4 or later to address the missing authorization checks. Review and restrict backend user permissions, especially for the history[article_rollback] privilege.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart