CVE-2026-116898

HIGH 7.1

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

CWE	CWE-639
Vendor	redaxo
Product	core
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for redaxo core

Be the first to know when new high vulnerabilities affecting redaxo core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

redaxo / core

0 < 5.21.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/redaxo/core/security/advisories/GHSA-j9mx-x52f-48cw vulncheck.com: https://www.vulncheck.com/advisories/redaxo-before-5.21.4-missing-authorization-in-media-pool-bulk-move

Credits

🔍 V-C-Williams