CVE-2026-116899: REDAXO before 5.21.4 Broken Access Control in Slice Operations
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the contentslicestatus and contentmoveslice APIs to delete, toggle, move, or overwrite other editors' slices.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with editor privileges can exploit it. The attacker must be able to submit slice operations using an article they are permitted to access together with a slice ID belonging to an unauthorized category.
What actions can an attacker perform?
An attacker can delete, toggle status, move, or overwrite slices belonging to other editors in unauthorized categories. The affected operations include content/edit delete and edit functions, plus the content_slice_status and content_move_slice APIs.
Which versions are affected?
REDAXO versions before 5.21.4 are affected. Updating to 5.21.4 or later addresses the stated affected-version range.