Skip to content
High-Risk Vulnerability in REDAXO Backup Addon Exposes User Data

High-Risk Vulnerability in REDAXO Backup Addon Exposes User Data

First seen 28 Oct 2026, 02:21 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 04:19 UTC
  • •CVE-2026-116896 allows unauthorized data exports from REDAXO CMS.
  • •Non-admin users can access sensitive authentication data if granted backup[export] permission.
  • •Upgrade to REDAXO version 5.21.5 to mitigate the vulnerability.

A missing authorization vulnerability (CVE-2026-116896) was discovered in REDAXO versions prior to 5.21.5, allowing non-admin users with backup[export] permissions to export sensitive database tables. This includes rex_user and rex_user_session, which contain plaintext session IDs and password hashes, enabling potential account takeovers. The flaw affects organizations using the REDAXO CMS with the backup addon enabled and improperly assigned permissions. The vulnerability was published on October 27, 2026, with a CVSS score of 7.7, indicating high severity. No active exploitation has been confirmed, but the risk remains significant for exposed systems. Users are advised to upgrade to the fixed version and review access permissions immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
CVE-2026-116896 published
The vulnerability affecting REDAXO was disclosed, highlighting risks to user data and potential account takeovers.
Redpacketsecurity
2026-10-28
Advisory released on GitHub
GitHub published an advisory detailing the vulnerability and its implications for non-admin users with export permissions.
github.com

More articles in this cluster (2)

Following this threat?

Track CVE-2026-116896 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

What versions of REDAXO are affected?
Versions prior to 5.21.5 are affected by this vulnerability.
Is there any confirmed exploitation of this vulnerability?
No active exploitation has been confirmed at this time.
What immediate actions should be taken?
Upgrade to REDAXO version 5.21.5 and review user permissions for the backup[export] role.