CVE-2026-116893— REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

Quick assessment

Affected

redaxo core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 5.21.5 之前的 REDAXO 核心中， API 函数存在授权缺失漏洞，使得非管理员后台用户仅凭有效的 CSRF 令牌即可管理扩展包。持有令牌的攻击者（例如拥有活跃会话但权限已被降级的前管理员）可以执行以下操作：卸载系统附加组件（如，这将导致其数据库表被删除）、停用、安装或激活扩展包，以及删除非系统扩展包。

CVSS 6.8 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

Source: CVE Program / CVE List V5

Vulnerability Description

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
redaxo	core	0 ~ 5.21.5	-

II. Public POCs for CVE-2026-116893

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116893

请登录查看更多情报信息。

Other References for CVE-2026-116893 (3)

https://github.com/redaxo/core/commit/bd96cf27c2ab919b8320264c9f5502753aa82f28 patch
https://github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx vendor-advisory
https://www.vulncheck.com/advisories/redaxo-core-before-5.21.5-missing-authorization-in-rex-api-package-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116893

Same Patch Batch · redaxo · 2026-10-27 · 15 CVEs total

CVE-2026-117532	9.8 CRITICAL	REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
CVE-2026-117536	8.8 HIGH	REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
CVE-2026-116896	7.5 HIGH	REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
CVE-2026-116898	7.1 HIGH	REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
CVE-2026-116897	6.5 MEDIUM	REDAXO before 5.21.4 Missing Authorization in Version and History Previews
CVE-2026-116899	6.5 MEDIUM	REDAXO before 5.21.4 Broken Access Control in Slice Operations
CVE-2026-117535	6.1 MEDIUM	REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-117534	5.4 MEDIUM	REDAXO before 5.21.3 CSRF in Article History Plugin
CVE-2026-116900	5.4 MEDIUM	REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
CVE-2026-116895	5.4 MEDIUM	REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
CVE-2026-117533	4.4 MEDIUM	REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-116894	4.2 MEDIUM	REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-117538	4.1 MEDIUM	REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
CVE-2026-117537	4.1 MEDIUM	REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

IV. Related Vulnerabilities

Same product: core

Same vendor: redaxo

Same weakness: CWE-862