CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117534

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117534

REDAXO versions prior to 5.21.3 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the structure/history plugin . The root cause is the use of unvalidated GET requests to perform sensitive actions. An attacker can lure authenticated backend users to a malicious page that t...

CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

EUVD-2026-110799

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532

REDAXO core versions 5.3.0 through 5.21.4 are vulnerable to an authentication bypass within the structure/history plugin. This flaw allows unauthenticated attackers to force the session-tied secret into a predictable state , enabling the forgery of temporary login tokens. An attacker can leverage...

EUVD-2026-110797

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-116897

REDAXO core versions prior to 5.21.4 are vulnerable to a missing authorization vulnerability within the structure/version and structure/history frontend preview modes. The underlying cause is a failure to verify category or clang permissions for previewed articles. Consequently, any backend user,...

CVE-2026-116897 REDAXO before 5.21.4 Missing Authorization in Version and History Previews

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding historyarticlerollback, can set rexversion o...

EUVD-2026-110793

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding historyarticlerollback, can set rexversion o...

PT-2026-126367

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

PT-2026-126369

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex history...

PT-2026-126362

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding historyarticle rollback, can set rex version...