CVE-2026-116898

HighCVSS 7.1/10Last modified Oct 27, 2026

Description

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2026
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1168996.5REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categ CVE-2026-11698.8A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation le CVE-2026-116907.5Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the rend CVE-2026-1169005.4REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped va CVE-2026-116913.1Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compro CVE-2026-116928.3Use after free in Read Anything in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process CVE-2026-1169226.5Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose inf CVE-2026-1169238.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1169258.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1169267.5Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to p CVE-2026-1169278.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1169289.8Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.