REDAXO versions before 5.21.4 contain a broken access control flaw that permits authenticated editor users to modify slices in categories they do not own. By supplying a valid article ID together with a foreign slice identifier, the attacker can use normal content editing or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite slices created by other editors. This flaw falls under CWE‑639, which involves unauthorized modification of privileges or roles.

The affected product is REDAXO Core, any installation running a version earlier than 5.21.4. All customers using these legacy releases are potentially vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity for this vulnerability. While an EPSS score is not available, the lack of an entry in the CISA KEV catalog suggests that exploitation is not yet widespread. The attack requires legitimate editor credentials, so the threat is limited to organizations with authorized editor access and likely depends on the presence of inadequate role separation within the content management configuration.