CVE-2026-116897
CVE-2026-116897 · REDAXO before 5.21.4 Missing Authorization in Version and History Previews
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
CVSS 7.1 · Alta · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
core
- Versiones
- ≥ 0, < 5.21.4: Afectada (semver)
- 5.21.4: No afectada (semver)
Actualiza a 5.21.4