Session Expiration Flaw in REDAXO by Giletta
CVE-2026-116894

2.3LOW

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116894?

The REDAXO content management system prior to version 5.21.5 is susceptible to an insufficient session expiration vulnerability. This issue allows attackers to maintain backend access to a user account even after a password change by exploiting a valid session ID or stay-logged-in cookie. Once obtained, the attackers can use this cookie to access sensitive areas of the application for up to three months, posing significant security risks to users.

Affected Version(s)

core 0 < 5.21.5

core 5.21.5

References

https://github.com/redaxo/core/security/advisories/GHSA-m...
vendor-advisory
https://github.com/redaxo/core/commit/672d22a779bfce7aa4a...
patch
https://www.vulncheck.com/advisories/redaxo-before-5.21.5...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.