CVE-2026-116896 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO versions prior to 5.21.5 represents a critical failure in access control mechanisms within the backup addon export functionality. This flaw is classified under CWE-862, which denotes Missing Authorization, as the application fails to enforce proper restrictions on who can perform specific actions or access certain resources. Specifically, the vulnerability arises because the export feature does not adequately validate whether the requesting user has sufficient privileges to access sensitive database tables beyond their intended scope. While administrative users are expected to have broad access for system maintenance and backup purposes, non-administrative users possessing only the basic backup[export] permission were inadvertently granted the ability to query and extract data from any table within the database schema. This lack of granular permission checking allows a significant escalation in privileges without requiring additional authentication or exploitation of complex code logic flaws.
The technical impact of this vulnerability is severe due to the nature of the data accessible through the compromised export function. Attackers with low-level access can target high-value tables such as rex_user and rex_user_session, which contain critical identity and session management information. By exporting these tables, an attacker gains immediate access to plaintext session identifiers and stay-logged-in keys associated with active user sessions. These credentials are particularly dangerous because they allow for account takeover attacks where the adversary does not need to crack passwords or exploit authentication bypasses; instead, they can simply inject valid session cookies into their browser to impersonate legitimate administrators. Furthermore, if password hashes are exported from the rex_user table, attackers can perform offline brute-force or dictionary attacks against these hashes at high speed, potentially revealing plaintext credentials for multiple accounts including those with elevated privileges.
From an operational perspective, this vulnerability undermines the integrity and confidentiality of the entire REDAXO installation. The ability to extract session data effectively neutralizes existing authentication controls, allowing persistent unauthorized access that is difficult to detect through standard login monitoring alone. Additionally, the exposure of password hashes contributes to long-term security risks even if immediate account takeover does not occur, as hashed passwords may be vulnerable to modern cracking techniques depending on their complexity and hashing algorithm strength. This scenario aligns with MITRE ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or session tokens to maintain access and move laterally within the environment. The lack of authorization checks also reflects CWE-269, Improper Privilege Management, indicating a systemic issue in how permissions are mapped to database operations rather than an isolated coding error.
To mitigate this vulnerability, organizations running REDAXO must immediately upgrade to version 5.21.5 or later, where the backup addon has been patched to enforce strict authorization checks on exported tables. Until upgrading is possible, administrators should restrict the backup[export] permission to only those users who absolutely require it for operational purposes and ensure that these individuals are trusted personnel with strong authentication practices. It is also advisable to review audit logs for any suspicious export activities prior to patching, as attackers may have already exploited this flaw to extract sensitive data. Implementing additional security controls such as multi-factor authentication can help mitigate the risk of account takeover via stolen session tokens, although upgrading remains the only definitive solution to address the underlying authorization deficiency in the software architecture.