CVE-2026-116896: REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rexuser, rexusersession, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A non-admin REDAXO user who has the backup[export] permission can exploit it. The attacker does not need administrator privileges or user interaction.
What access could an attacker gain from exported data?
Exporting rex_user_session data can expose plaintext session IDs and stay-logged-in keys that may be used to take over administrator accounts. Exported rex_user data can also expose password hashes for offline cracking.
Are deployments affected by default?
The provided information identifies exposure based on whether a non-admin user has the backup[export] permission. It does not state whether that permission is assigned to non-admin users by default.
What can be done if upgrading is not immediately possible?
Restrict or remove the backup[export] permission from non-administrative users to prevent them from exporting authentication-related and other application tables.
How can an organization determine whether it may already be affected?
Review users assigned the backup[export] permission and examine whether they could have exported rex_user, rex_user_session, or other sensitive tables. The provided information does not identify specific audit logs or indicators of prior exploitation.