GHSA-j9mx-x52f-48cw: REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

Published Oct 27, 2026

Updated

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade REDAXO to a version that resolves this vulnerability.
Fixed in 5.21.4

Event History

Oct 27, 2026

CVE Published

via OSV·10:59 AM

Data Sourced

via OSV·10:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated REDAXO backend user who has permission for at least one media category can exploit it. The user does not need permission to the restricted source category containing the files they move.

What access and conditions are required for exploitation?

The attacker needs backend authentication and permission for a target media category. They can bulk-move files from a restricted source category into that permitted category, because the operation checks target-category permission but not source-category permission.

What is the likely impact after files are moved?

After moving files into a category they are allowed to manage, the attacker can silently replace the files' contents. This can affect the content wherever those media files are used site-wide.

Which versions are affected?

REDAXO versions before 5.21.4 are affected. Upgrading to 5.21.4 or later addresses the described authorization gap.

GHSA-j9mx-x52f-48cw: REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and conditions are required for exploitation?

What is the likely impact after files are moved?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and conditions are required for exploitation?

What is the likely impact after files are moved?

Which versions are affected?