CVE-2026-116897: REDAXO before 5.21.4 Missing Authorization in Version and History Previews
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[articlerollback], can set rexversion or rexhistorydate with arbitrary articleid values to read unpublished working versions and historic or deleted content.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXO coreto a version that resolves this vulnerability.Fixed in 5.21.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated REDAXO backend user can exploit the affected preview modes. A user holding the history[article_rollback] permission can also exploit it.
What does an attacker need to do to access content?
The attacker must be able to set rex_version or rex_history_date with an arbitrary article_id in the structure/version or structure/history frontend preview modes. The affected modes fail to verify category or clang permissions for the selected article.
What information could be exposed?
An attacker may read unpublished working versions as well as historic or deleted article content. The issue affects confidentiality; the provided data does not indicate integrity or availability impact.
Which installations are affected?
REDAXO core versions before 5.21.4 are affected. The issue is reachable through the specified frontend preview modes and requires an authenticated backend user or the stated history permission.