CVE-2026-116899
Received Received - Intake

REDAXO CMS Broken Access Control in Slices Editing

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116899
EUVD
EUVD-2026-110795

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redaxo core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

REDAXO before 5.21.4 has a broken access control flaw where authenticated editors can modify slices in unauthorized categories. By pairing a permitted article with a foreign slice ID, attackers can exploit functions like delete, edit, or APIs such as content_slice_status and content_move_slice to delete, toggle, move, or overwrite slices belonging to other editors.

Detection Guidance

Check if your REDAXO instance is running a version below 5.21.4 by inspecting the version file or admin panel. Monitor logs for unauthorized slice modifications, deletions, or status changes in categories where the user lacks permissions.

Impact Analysis

If you are an editor using REDAXO versions below 5.21.4, attackers with edit permissions can delete, modify, or move your slices without authorization. This could lead to unauthorized content changes, loss of work, or disruption of website functionality.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or deletions, potentially violating integrity requirements in GDPR and HIPAA. Unauthorized changes to content may also impact data accuracy and accountability, posing compliance risks.

Mitigation Strategies

Upgrade REDAXO to version 5.21.4 or later immediately. Review user permissions to ensure editors only have access to necessary categories. Audit recent slice modifications for signs of unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart