UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126318

REDAXO before 5.21.6 Authorization Bypass of Live Version Permission

Severity
Medium 5.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
5.21.6
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.

From the CVE Program.

Affected software

SoftwareAffected versions
REDAXOServers and applications · cna:redaxo|core
  • Every version before 5.21.6

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126318