CVE-2026-116899

MEDIUM 6.5

REDAXO before 5.21.4 Broken Access Control in Slice Operations

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

CWE	CWE-639
Vendor	redaxo
Product	core
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for redaxo core

Be the first to know when new medium vulnerabilities affecting redaxo core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

redaxo / core

0 < 5.21.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/redaxo/core/security/advisories/GHSA-5m63-c3qx-wq8v vulncheck.com: https://www.vulncheck.com/advisories/redaxo-before-5.21.4-broken-access-control-in-slice-operations

Credits

🔍 V-C-Williams