CVE-2026-126318

REDAXO before 5.21.6 Authorization Bypass of Live Version Permission

REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Redaxo

CVE-2026-117538

REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117534

REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116899

REDAXO before 5.21.4 Broken Access Control in Slice Operations

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116895

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117536

REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117532

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116897

REDAXO before 5.21.4 Missing Authorization in Version and History Previews

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116893

REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117535

REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116900

REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116896

REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117537

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116894

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-116898

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-117533

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-63002

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-63001

REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-63000

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo

CVE-2026-62998

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redaxo

Products

Core Redaxo