CVE-2026-116896

REDAXO versions before 5.21.5 are vulnerable to a missing authorization flaw in the backup addon export functionality. The component incorrectly permits non-admin users possessing the backup[export] permission to export any database table, including rex_user and rex_user_session. This allows atta...

CVE-2026-116896 REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backupexport permission to export rexuser, rexusersession, and other applications' tables. Attackers can obtain plaintext session ids a...