GHSA-phjc-vx3j-58r3: REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

Published Oct 27, 2026

Updated

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rexuser, rexusersession, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.

Event History

Oct 27, 2026

CVE Published

via OSV·10:59 AM

Data Sourced

via OSV·10:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A non-admin REDAXO user who has the backup[export] permission can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.

What sensitive data can be exposed through the backup export?

The affected export function can export rex_user, rex_user_session, and tables belonging to other applications. This may expose plaintext session IDs, stay-logged-in keys, and password hashes.

What could an attacker do with the exported data?

Plaintext session IDs or stay-logged-in keys may allow an attacker to take over administrator accounts. Exported password hashes may be subjected to offline cracking.

What should be done if an update cannot be applied immediately?

Remove or restrict the backup[export] permission for non-admin users to prevent them from exporting arbitrary database tables.

GHSA-phjc-vx3j-58r3: REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

Event History

Frequently Asked Questions

Who can exploit this issue?

What sensitive data can be exposed through the backup export?

What could an attacker do with the exported data?

What should be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What sensitive data can be exposed through the backup export?

What could an attacker do with the exported data?

What should be done if an update cannot be applied immediately?