CVE-2026-116898 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within the REDAXO content management system prior to version 5.21.4 and specifically affects the media pool functionality used for bulk file operations. This vulnerability is classified as a missing authorization issue where the application fails to enforce proper access control checks on all relevant resources involved in an operation. While the software correctly validates whether the authenticated backend user possesses permission to write or modify files within the target category, it completely neglects to verify if the same user has read or move permissions for the source category from which the media assets are being transferred. This asymmetric validation logic creates a critical gap that allows users with limited privileges to bypass intended security boundaries by leveraging their access rights in one area to manipulate resources in another restricted area.
From a technical perspective, this flaw represents an insecure direct object reference combined with broken access control principles. When a user initiates a bulk move operation, the backend processes the request based solely on the destination permissions. Consequently, any authenticated individual who has been granted write access to at least one media category can select files from categories they do not have explicit permission to view or modify and relocate them into their permitted directory structure. The system does not perform a secondary check against the source location's security policy during this transactional process. This oversight enables an attacker with low-level privileges to escalate their effective capabilities by gaining unauthorized access to sensitive media assets that were intended to be isolated from general staff members or lower-tier editors.
The operational impact of this vulnerability is significant, particularly in environments where multiple users share backend access with varying levels of trust and responsibility. An adversary can exploit this flaw to exfiltrate confidential documents, images, or other proprietary data stored within restricted media categories that are normally inaccessible to their account level. Furthermore, the ability to silently replace file contents site-wide introduces a risk of integrity compromise. By moving files from secure locations into accessible ones, an attacker could potentially overwrite existing assets with maliciously crafted versions if subsequent upload capabilities exist in the target directory. This undermines the confidentiality and integrity guarantees provided by the system's role-based access control model, leading to potential data breaches or defacement depending on how the moved content is utilized within the application logic.
This vulnerability aligns closely with Common Weakness Enumeration category CWE-269, which addresses Improper Privilege Management, as well as CWE-862 regarding Missing Authorization checks that fail to verify access rights for specific resources. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to bypass restrictions and move laterally or escalate privileges within the application environment by exploiting misconfigured permissions rather than breaking authentication mechanisms entirely. The silent nature of the replacement also touches upon aspects of data manipulation that can evade standard audit logs if those logs do not adequately distinguish between authorized moves from permitted sources versus unauthorized ones.
To mitigate this risk, organizations running REDAXO versions earlier than 5.21.4 must upgrade to the patched release immediately as it addresses these authorization checks by ensuring both source and destination permissions are validated before allowing any bulk move operation. Until an update can be applied, administrators should review user roles within the backend interface and restrict write access in media categories only to those individuals who absolutely require such privileges for their job functions. Implementing stricter separation of duties between content creators who need read-only access to sensitive archives and editors who manage public-facing assets can reduce the attack surface. Additionally enabling comprehensive audit logging that records not just successful actions but also permission checks might help detect anomalous bulk movements in real-time, allowing security teams to respond quickly if exploitation is suspected.