Missing Authorization in REDAXO - #VU140847
Published: August 4, 2026
Vulnerability identifier: #VU140847
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the frontend preview mode of the structure/version and structure/history plugins when handling preview requests for article content selected by request parameters. A remote user can send a crafted frontend request to disclose sensitive information.
Exploitation requires an active backend session and the relevant plugin to be installed and enabled. The issue can expose unpublished working versions, historic snapshots, and previously deleted content when such data exists for the targeted article.
Affected software
REDAXO
Remediation
Install security update from vendor's website.
REDAXO - update to 5.21.4