---
id: CVE-2026-116898
title: REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
summary: >-
  REDAXO before 5.21.4 contains a missing authorization vulnerability in the
  media pool bulk move that checks only target category permission, ignoring the
  source category. Authenticated backend users with permission for one media
  category…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: redaxo
product: core
affected:
  - core < 5.21.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:42:29.206400Z'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:12:38.103Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116898'
references:
  - url: 'https://github.com/redaxo/core/security/advisories/GHSA-j9mx-x52f-48cw'
    label: GitHub Security Advisory (GHSA-j9mx-x52f-48cw)
  - url: >-
      https://www.vulncheck.com/advisories/redaxo-before-5.21.4-missing-authorization-in-media-pool-bulk-move
    label: >-
      VulnCheck Advisory: REDAXO before 5.21.4 Missing Authorization in Media
      Pool Bulk Move
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.437Z'
---

## Overview

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

## Affected

- `core < 5.21.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.