CVE-2026-116898
CVE-2026-116898 · REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
This page contains facts from public vulnerability sources. Check the original advisory before updating.
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
CVSS 7.1 · High · Fix available
- Published
- Updated
Affected products and versions
core
- Versions
- ≥ 0, < 5.21.4: Affected (semver)
- 5.21.4: Not affected (semver)
Update to 5.21.4