CVE Alert: CVE-2026-116896 – redaxo

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications’ tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.

**Risk verdict:** This is a high-impact exposure for sites where a low-privilege account can export backups; urgency cannot be confirmed because exploitation and probability indicators were not supplied.

**Why this matters:** Exposed authentication material could enable account takeover, including administrative access, while other exported data may reveal sensitive business information. An attacker could use this access to alter site content or configuration, disrupt service, or pursue further access using credentials reused elsewhere. No KEV, SSVC, PoC or EPSS data is provided, so active exploitation and likelihood remain uncertain.

**Most likely attack path:** The attacker needs network access and a valid account with the backup-export permission; no victim interaction is required. The access-control failure may let that account export authentication tables, but the scope assessment indicates impact is confined to the vulnerable application rather than automatically crossing into other systems.

**Who is most exposed:** Organisations running the affected CMS with the backup addon enabled and export permission assigned beyond trusted administrators are most at risk, especially where the management interface is internet-accessible.

Review backup-export audit logs and unusual export requests or volumes.

Look for exports involving authentication, session, or unrelated application tables.

Check for unexpected administrator sessions or persistent-login activity after exports.

Identify accounts newly granted backup-export permission.

Mitigation and prioritisation

Upgrade to the vendor-fixed release; prioritise internet-facing instances and restrict access during rollout.

Remove backup-export permission from non-essential accounts; disable the addon if unused.

Revoke sessions and persistent-login tokens, and rotate credentials if sensitive exports may have occurred.

Confirm patch completion and review change/audit logs for suspicious exports.

Reassess priority when KEV and EPSS data are available; treat as priority 1 if KEV is true or EPSS is at least 0.5.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.