PT-2026-126364
CVE-2026-116899
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content slice status and content move slice APIs to delete, toggle, move, or overwrite other editors' slices.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾