CVE-2026-116896

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.5

Description A missing authorization issue exists in the backup addon export feature. This allows non-admin users who possess the backup[export] permission to export sensitive database tables, including rex user and rex user session. An attacker can exploit this to obtain plaintext session IDs and stay-logged-in keys to hijack administrator accounts, or retrieve password hashes for offline cracking.

Recommendations Update to version 5.21.5 or later.