CVE-2026-116893Medium· 6.8▾ SunlitREDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
core < 5.21.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116897Medium· 6.5REDAXO before 5.21.4 Missing Authorization in Version and History Previews
CVE-2026-116896High· 7.5REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
CVE-2026-117533Medium· 4.4REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-116894Medium· 4.2REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-117537Medium· 4.1REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
CVE-2026-116898High· 7.1REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move