CVE-2026-116896

CVE-2026-116896CVE-2026-116896

Description

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Last modified2026-10-27
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.