Is CVE-2026-116898 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116898 being exploited in the wild.

How severe is CVE-2026-116898?

High severity, with a CVSS score of 7.1, published 27 October 2026.

How is CVE-2026-116898 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116898?

Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116898: REDAXO media pool authorization bypass in bulk move

CVE-2026-116898 · Severity: high · CVSS 7.1 · Published 2026-10-27

REDAXO is a web content management system that uses a permission-based media pool to control access to files like images and PDFs. An authenticated backend user with permission to access one media category can exploit a missing authorization check to move restricted files into their permitted category and then silently replace the file contents site-wide, affecting every page that uses it.

Technologies: REDAXO. Vendors: REDAXO.

Quick answers

Is CVE-2026-116898 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116898 being exploited in the wild.
How severe is CVE-2026-116898?: High severity, with a CVSS score of 7.1, published 27 October 2026.
Which products and versions are affected?: REDAXO before 5.21.4.
Is there a fix for CVE-2026-116898?: Yes: fixed in 5.21.4. Until then: Until upgrading, only grant media category permissions to users where they are permitted to control every file reachable from that category, including files from subcategories which are included in searches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116898 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116898?: Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.21.4

Until upgrading, only grant media category permissions to users where they are permitted to control every file reachable from that category, including files from subcategories which are included in searches.

Technical details

The media pool bulk move function checks only that the user has write permission for the target category, but fails to verify permission for the source category of files being moved. An authenticated user with write permission to any media category can move files from restricted categories into that category by filename, then use the edit interface to replace the file contents. The vulnerability is a missing authorization check (CWE-639) in the bulk move handler compared to the single-file move and bulk delete operations which properly check source permissions.

Affected products

REDAXO REDAXO before 5.21.4

Timeline

2026-08-03: disclosed
2026-10-27: advisory
2026-10-27: patched: 5.21.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.