PT-2026-126362
CVE-2026-116897
·
تاريخ النشر
2026-10-27
·
تاريخ التحديث
2026-10-27
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article rollback], can set rex version or rex history date with arbitrary article id values to read unpublished working versions and historic or deleted content.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾