Description
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
Published: 2026-10-27
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized Disclosure of unpublished content
Action: Immediate Patch
AI Analysis

Impact

The flaw is a missing access control check in the frontend preview modes that allow a backend user or anyone with history[article_rollback] permission to override the article ID in the preview URL or form. By providing a different article_id in the rex_version or rex_history_date parameters, an attacker can retrieve any unpublished, historical, or deleted version of an article. The outcome is an unauthorized disclosure of confidential site content that the audience has not yet approved, compromising confidentiality and potentially revealing business information.

Affected Systems

The vulnerability affects Redaxo CMS core versions earlier than 5.21.4. The affected product is the Redaxo content management system provided by the Redaxo Core team.

Risk and Exploitability

CVSS 7.1 indicates high severity. Although EPSS is not available, the vulnerability does not require special conditions beyond a legitimate backend session or the history[article_rollback] permission. Anyone who can authenticate to the backend can manipulate the preview parameters to read arbitrary unpublished content. The vulnerability is not listed in the CISA KEV catalog, but due to its high impact it warrants prompt remediation.

Generated by OpenCVE AI on October 27, 2026 at 12:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Redaxo patch (5.21.4 or newer).
  • Restrict backend user privileges, removing history[article_rollback] from users that do not need it.
  • Implement strict access controls to prevent unauthorized backend access and consider disabling or restricting the preview parameters for users without sufficient permissions.

Generated by OpenCVE AI on October 27, 2026 at 12:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Description REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
Title REDAXO before 5.21.4 Missing Authorization in Version and History Previews
First Time appeared Redaxo
Redaxo redaxo
Weaknesses CWE-862
CPEs cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*
Vendors & Products Redaxo
Redaxo redaxo
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Redaxo Redaxo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T10:59:26.165Z

Reserved: 2026-10-27T01:02:44.942Z

Link: CVE-2026-116897

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T11:17:32.653

Modified: 2026-10-27T11:17:32.653

Link: CVE-2026-116897

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T12:30:02Z

Weaknesses