CVE-2026-116898: REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXOto a version that resolves this vulnerability.Fixed in 5.21.4
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated REDAXO backend user who has permission for at least one media category may be able to exploit it. The user does not need permission for the restricted source category if they can select a permitted target category.
What access does an attacker need?
An attacker needs an authenticated backend account and permission to a media category that can be used as the move destination. Exploitation does not require user interaction or a complex attack path.
What is the likely impact of successful exploitation?
An attacker can move files out of restricted media categories into a category they are allowed to manage. They can then replace those files' contents, potentially affecting sites wherever the files are used.
Which versions should be remediated?
REDAXO versions before 5.21.4 are affected. Updating to 5.21.4 or later addresses the affected version range described.