https://feed.craftedsignal.io/cpes/cpe2.3aredaxoredaxo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 11:46:51 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass-a96c1342/Tue, 27 Oct 2026 11:46:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass-a96c1342/REDAXO versions prior to 5.21.5 contain a missing authorization flaw in the backup addon that allows unauthorized export of sensitive database tables.REDAXO versions before 5.21.5 contain a missing authorization vulnerability in the backup addon. Users possessing the 'backup[export]' permission can export arbitrary database tables, including 'rex_user' and 'rex_user_session', which contain sensitive credentials such as plaintext session IDs, persistent login keys, and password hashes. This allows attackers to perform account takeover or offline password cracking.

Impact

Unauthorized access to sensitive database tables allows non-administrative users to extract credentials and session data, facilitating full administrative account takeover.

Recommendation

• Upgrade REDAXO to version 5.21.5 or later immediately.
• Review access control lists and revoke the 'backup[export]' permission from any user accounts that do not strictly require it for operational duties.
• Audit database export logs for unusual activity or unauthorized file access attempts.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass/Tue, 27 Oct 2026 11:46:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-redaxo-auth-bypass/REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin. The vulnerability allows unauthenticated attackers to manipulate the session-tied secret into a predictable state, facilitating the forgery of administrative login tokens. Successful exploitation grants attackers unauthorized backend access and the ability to achieve code execution.

Impact

Successful exploitation results in full unauthorized backend access and subsequent code execution.

Recommendation

• Upgrade to REDAXO version 5.21.4 or later immediately to patch CVE-2026-117532.
• Audit web server access logs for anomalous requests directed at the 'structure/history' plugin endpoint that result in successful logins.
• Monitor for unexpected administrative logins originating from unfamiliar IP addresses.

]]>criticaladvisoryvulnerabilityauthentication-bypasswebserver