CVE-2026-116899Medium· 6.5▾ SunlitREDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit de…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.
core < 5.21.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116898High· 7.1REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
CVE-2026-116185Medium· 5.0OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
CVE-2026-117533Medium· 4.4REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-116894Medium· 4.2REDAXO before 5.21.5 Insufficient Session Expiration on Password Change