REDAXO: Authorization bypass in backup addon (CVE-2026-116896)
REDAXO versions prior to 5.21.5 contain a missing authorization flaw in the backup addon that allows unauthorized export of sensitive database tables.
CVE search metadata
CVE search record: CVE-2026-116896. Severity: high. CVSS: 7.5. KEV: no. Product: REDAXO (< 5.21.5), REDAXO (< 5.21.3). Brief: REDAXO: Authorization bypass in backup addon (CVE-2026-116896). Brief link: https://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass-a96c1342/
CVE search record: CVE-2026-117536. Severity: high. CVSS: 8.8. KEV: no. Product: REDAXO (< 5.21.5), REDAXO (< 5.21.3). Brief: REDAXO: Authorization bypass in backup addon (CVE-2026-116896). Brief link: https://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass-a96c1342/
Triage facts
Revision 1- Applicability
- REDAXO (< 5.21.5), REDAXO (< 5.21.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 27, 11:46 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for REDAXO (< 5.21.3) Oct 27, 11:47 via nvd
REDAXO versions before 5.21.5 contain a missing authorization vulnerability in the backup addon. Users possessing the 'backup[export]' permission can export arbitrary database tables, including 'rex_user' and 'rex_user_session', which contain sensitive credentials such as plaintext session IDs, persistent login keys, and password hashes. This allows attackers to perform account takeover or offline password cracking.
Impact
Unauthorized access to sensitive database tables allows non-administrative users to extract credentials and session data, facilitating full administrative account takeover.
Recommendation
- Upgrade REDAXO to version 5.21.5 or later immediately.
- Review access control lists and revoke the 'backup[export]' permission from any user accounts that do not strictly require it for operational duties.
- Audit database export logs for unusual activity or unauthorized file access attempts.
Immediate actions
Patch REDAXO to 5.21.5
Upgrade REDAXO to 5.21.3 or later
Threat Hunt
Identify unauthorized database exports initiated by users with backup[export] privileges
Data: Application access logs tracking backup addon usage, Database export event logs
Identify suspicious GET requests to user administration backend pages that include FUNC_UPDATE
Data: Web server access logs
Mitigations
Upgrade REDAXO to 5.21.5
CVE-2026-116896
Apply security update to version 5.21.3
CVE-2026-117536