Missing Authorization Vulnerability in REDAXO Backup Addon
CVE-2026-116896

7.7HIGH

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116896?

A missing authorization vulnerability was found in the REDAXO backup addon prior to version 5.21.5. This flaw allows non-administrative users, with the designated backup[export] permission, to access and export sensitive database tables including rex_user and rex_user_session. Through this exploitation, attackers can retrieve plaintext session identifiers and stay-logged-in keys, facilitating the unauthorized takeover of administrator accounts. Additionally, the vulnerability exposes password hashes that could enable offline cracking attempts, significantly compromising the integrity of the platform.

Affected Version(s)

core 0 < 5.21.5

core 5.21.5

References

https://github.com/redaxo/core/security/advisories/GHSA-p...
vendor-advisory
https://www.vulncheck.com/advisories/redaxo-before-5.21.5...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alham-rizvi
AlpetGexha
.