REDAXO before version 5.21.4 has a missing authorization check in the media pool bulk move operation; it verifies only the target category permission and ignores the source category. An authenticated backend user who has write access to one media category can move files from restricted categories into that category. The move operation silently replaces the source files’ contents site‑wide, effectively allowing the attacker to overwrite media assets without permission. This vulnerability is a CWE‑639 authorization bypass and can result in unauthorized modification of site content, potentially leading to defacement or injection of malicious assets.

The affected product is REDAXO core, with all releases prior to 5.21.4 vulnerable.

The CVSS score of 7.1 indicates moderate‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, which suggests limited public exploitation data. The attack requires a valid backend user account with permission to at least one media category; no additional conditions or network access are required. Once authenticated, the attacker can exploit the flaw without further constraints, making it likely a high‑risk issue for internal users or compromised credentials.