CVE-2026-116899 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within REDAXO versions prior to 5.21.4 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-639 as an authorization bypass through indirect object reference. This flaw arises from the application's insufficient validation of resource ownership when processing requests related to content slices. In this context, a slice refers to a discrete unit of content within an article structure. The system correctly verifies that the authenticated user possesses permission to access or modify the specific article identified in the request parameters. However, it fails to verify whether the associated slice identifier belongs to that same authorized article or if it references a resource owned by another entity within the database. This logical gap allows an attacker who has valid authentication credentials with editor-level privileges to manipulate content outside their intended scope of authority.
The technical exploitation mechanism relies on the ability to pair a permitted article ID, which the user is allowed to edit, with a slice ID that belongs to a different article or category. By constructing HTTP requests that target functions such as content/edit delete and edit, or by directly invoking APIs like content_slice_status and content_move_slice, an attacker can supply these mismatched identifiers. The server processes these requests based on the valid article permission but applies the action to the foreign slice ID provided in the payload. This lack of cross-referencing between the resource container (the article) and the specific sub-resource (the slice) constitutes a classic broken access control scenario where identity verification is performed, but authorization checks against the specific target object are omitted or flawed.
The operational impact of this vulnerability is significant for organizations relying on REDAXO as their content management system. An authenticated attacker can delete slices belonging to other editors, effectively removing critical content from published articles without detection through standard audit logs that might only show edits by a legitimate user. Furthermore, the ability to toggle slice status allows an adversary to hide or expose specific pieces of information arbitrarily, disrupting editorial workflows and potentially causing data inconsistency across the platform. The capability to move slices enables the reorganization of unrelated content, which can lead to structural integrity issues within articles and confuse end-users viewing the website. Most critically, the potential to overwrite other editors' slices means that an attacker could replace legitimate text or media with malicious content, facilitating defacement, misinformation campaigns, or further exploitation vectors if the overwritten content is processed in a way that triggers secondary vulnerabilities such as cross-site scripting.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1496 Resource Hijacking depending on the intent of overwriting or defacing content. The attack vector is classified as local network-based if internal access is required, but could be remote if authentication credentials are compromised via other means such as phishing or credential stuffing. To mitigate this risk, immediate patching to version 5.21.4 or later is essential, as the vendor has addressed these authorization checks in subsequent releases. In environments where upgrading is not immediately feasible, administrators should implement strict input validation on the server side to ensure that slice IDs are strictly bound to their parent article IDs before processing any modification requests. Additionally, enabling comprehensive audit logging for all content manipulation events can aid in detecting anomalous patterns of access and facilitate forensic analysis if an incident occurs. Regular security assessments focusing on broken object level authorization flaws should be integrated into the development lifecycle to prevent similar logical errors from persisting in future versions.