CVE-2026-126318: REDAXO before 5.21.6 Authorization Bypass of Live Version Permission
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[liveversion] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, contentslicestatus, contentmoveslice, history restore, or contentcopy, bypassing approval workflows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.21.6
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated REDAXO editor account is required. The affected users are editors who do not have the version[live_version] permission but can access the relevant content functions.
What can an attacker change through the bypass?
They can modify live article versions by adding, editing, deleting, toggling, or reordering live slices. The issue also affects history restore and content-copy actions, allowing approval workflows to be bypassed.
Are installations running REDAXO 5.21.6 affected?
The issue affects REDAXO versions before 5.21.6. The provided information does not identify 5.21.6 as affected.