What is CVE-2026-116893?

CVE-2026-116893 is a medium-severity vulnerability in Redaxo Core, classified under Missing Authorization. CVSS score: 6.8/10. Published 2026-10-27.

How severe is CVE-2026-116893?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Auth bypass in Redaxo Core

CVE-2026-116893

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.

Vulnerability class: Broken Access Control

Published 2026-10-27 · last modified 2026-10-27.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Redaxo Core

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

github.com/redaxo/core/commit/bd96cf27c2ab919b8320264c9f5502753aa82f28 (patch)
github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx (vendor-advisory)
www.vulncheck.com/advisories/redaxo-core-before-5.21.5-missing-authorization-in… (third-party-advisory)

Frequently asked questions

What is CVE-2026-116893?: CVE-2026-116893 is a medium-severity vulnerability in Redaxo Core, classified under Missing Authorization. CVSS score: 6.8/10. Published 2026-10-27.
How severe is CVE-2026-116893?: Medium severity. CVSS v3 base score is 6.8 out of 10.