CVE-2026-116896

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backupexport permission to export rexuser, rexusersession, and other applications' tables. Attackers can obtain plaintext session ids a...