CVE-2026-116893 Details
Description
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
A missing authorization vulnerability has been identified in the REDAXO core version 5.21.4 and prior, specifically within the rex_api_package API function. This vulnerability allows non-admin backend users to manage packages by simply possessing a valid CSRF token. For instance, a demoted admin with an active session could exploit this to uninstall critical system addons like 'structure', which would result in the loss of associated database tables and content. Additionally, the vulnerability could be used to deactivate, install, or activate packages, as well as delete non-system packages from the filesystem.
Users can upgrade to REDAXO version 5.21.5 or later, where this vulnerability has been addressed by requiring admin permissions for the rex_api_package function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| REDAXO | <= 5.21.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |