Broken Access Control in REDAXO by Yakamara

CVE-2026-116899

What is CVE-2026-116899?

The REDAXO CMS prior to version 5.21.4 is impacted by a vulnerability that permits authenticated editors to manipulate content slices across unauthorized categories. This is achieved by linking a legitimate article to an unrelated slice ID, which can allow malicious actors to exploit API functions for content slice editing, deletion, and movement. As a result, unauthorized changes to other editors' slices can occur, compromising content integrity and system stability.

References