CVE-2026-116898

EUVD-2026-110794
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
redaxoredaxo
𝑥
< 5.21.4
CNA
Common Weakness Enumeration
References
https://github.com/redaxo/core/security/advisories/GHSA-j9mx-x52f-48cw
https://www.vulncheck.com/advisories/redaxo-before-5.21.4-missing-authorization-in-media-pool-bulk-move