CVE-2026-117532
Received Received - Intake

Authentication Bypass in REDAXO Core via Structure/History Plugin

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117532
EUVD
EUVD-2026-110797

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redaxo core 5.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authentication bypass vulnerability in REDAXO core versions 5.3.0 through 5.21.3 affecting the structure/history plugin. Unauthenticated attackers can forge temporary login tokens by manipulating a predictable session-tied secret. This allows impersonation of privileged accounts like admin, granting unauthorized backend access and potential code execution outside live mode.

Detection Guidance

Check if the structure/history plugin is enabled in your REDAXO installation by inspecting the plugins directory or database. Look for unusual login attempts or sessions tied to privileged accounts like admin without prior authentication. Review server logs for requests to /redaxo/index.php?page=structure/history or similar paths.

Impact Analysis

Attackers can gain full backend control, access all content and user data, and in non-live mode installations, execute remote code. Even in live mode, unauthorized access to sensitive information and system functions is possible. The vulnerability has a critical severity score of 9.3.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could result in breaches of GDPR (data protection) and HIPAA (health information privacy). Organizations may face regulatory penalties and reputational damage.

Mitigation Strategies

Update REDAXO core to version 5.21.4 or later immediately. If updating is not possible, disable the structure/history plugin via the REDAXO backend or by removing it from the plugins directory. Monitor for unauthorized access or suspicious activity in admin accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117532. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart