CVE-2026-116896 Details

A missing authorization vulnerability has been identified in the REDAXO backup addon export feature, present in versions prior to 5.21.5. This vulnerability allows non-admin users with the 'backup[export]' permission to export any database table, including sensitive authentication tables such as 'rex_user', 'rex_user_session', and 'rex_user_passkey'. Exploitation of this vulnerability could lead to unauthorized access to plaintext session IDs and 'stay-logged-in' keys, facilitating admin account takeovers, or access to password hashes for offline cracking.

Users can upgrade to REDAXO version 5.21.5 or later, where this vulnerability has been fixed. In version 5.21.5, non-admin users can only export REDAXO tables (with the table prefix), excluding 'rex_user', 'rex_user_passkey', and 'rex_user_session'. Admins still have the ability to export all tables.