CVE-2026-116898
Received Received - Intake

REDAXO Media Pool Bulk Move Authorization Bypass

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116898
EUVD
EUVD-2026-110794

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redaxo core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116898 is a missing authorization vulnerability in REDAXO CMS versions before 5.21.4. It affects the media pool bulk move feature, where authenticated users can move files from restricted categories into a permitted category without proper permission checks for the source category. This allows unauthorized file content replacement across the site.

Detection Guidance

Check Redaxo CMS version with: grep -r "REDAXO_VERSION" /path/to/redaxo/core. If version is below 5.21.4, the system is vulnerable. Review media pool bulk move logs for unauthorized file transfers between categories.

Impact Analysis

An attacker with limited media access could replace critical files like logos, PDFs, or downloads with malicious content. This could deface the website, spread malware, or alter site functionality. The attack requires only an authenticated backend session and no cross-site scripting.

Compliance Impact

This vulnerability could lead to unauthorized data tampering, potentially violating integrity requirements in GDPR and HIPAA. If sensitive files are replaced, it may result in non-compliance with data integrity and access control provisions.

Mitigation Strategies

Upgrade Redaxo CMS to version 5.21.4 or later immediately. Temporarily restrict media category permissions to only necessary users until patching is complete. Monitor media pool activity for suspicious file movements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart