REDAXO before version 5.21.5 contains a missing authorization flaw that allows any user who has the backup[export] permission to export arbitrary database tables. Because the export feature does not restrict table names, non‑admin users can retrieve sensitive tables such as rex_user and rex_user_session. The attacker can then obtain plain‑text session IDs and persistent login keys, enabling immediate takeover of administrator accounts, or obtain password hashes for offline cracking. This improper authorization weakness (CWE‑862) leads to a full privilege escalation and credential theft scenario.

The affected product is Redaxo core before update 5.21.5. All installations running Redaxo core older than 5.21.5 are vulnerable; versions 5.21.5 and newer are not known to be affected.

The vulnerability has a CVSS score of 7.7, indicating a high severity. EPSS data is not available and the issue is not listed in KEV, but the flaw is exploitable from any threat actor that can log in and has the backup[export] capability. The attack vector is an authenticated web request that triggers the export of arbitrary tables. Once compromised, the attacker can elevate privileges and persist access through stolen session data or cracked passwords.