CVE-2026-116896 REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116896?
CVE-2026-116896 is a high-severity vulnerability in redaxo core, published on 27 Oct 2026.
Official description
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
Weakness: CWE-862
Which versions are affected by CVE-2026-116896?
How do I fix CVE-2026-116896?
No fix has been published for CVE-2026-116896 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116896 being exploited?
There is no known exploitation of CVE-2026-116896 in the wild and no public exploit code.
Sources
Also known as GHSA-c532-w5jh-m2g6, GHSA-phjc-vx3j-58r3.