CVE-2026-116893: fallo de gravedad media en redaxo core
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
redaxo · coreCVEs relacionadas — redaxo core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-117532CRITICALREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History PluginEPSS 0.7%CVE-2026-53599HIGHRedaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersEPSS 0.5%CVE-2026-62998MEDIUMREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationEPSS 0.4%CVE-2026-116896HIGHREDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication TablesEPSS 0.2%CVE-2026-116897HIGHREDAXO before 5.21.4 Missing Authorization in Version and History PreviewsEPSS 0.2%CVE-2026-117535MEDIUMREDAXO before 5.21.3 Reflected XSS via opener_link in Media PoolEPSS 0.2%