REDAXO Core CVE-2026-116893

Exploitation requires an authenticated backend user (PR:L) who possesses a valid CSRF token for the rex_api_package function. That token is only generated on backend pages restricted to administrators, so the practical precondition is that the user held admin permission earlier in the same still-active session and was then demoted (the session stays valid), or obtained the token through a separate vulnerability; a user who never had admin in the session cannot get a valid token through the normal backend. Package management is disabled in live mode, so live-mode installations are not affected. These factors (prior admin in-session, non-live deployment, valid-session dependency) are the real limiting conditions that keep this from being remotely exploitable against default unauthenticated users.

This is a medium-severity authorization flaw (vendor CVSS 4.0 base 6.1) whose signals point to a bounded, conditional risk rather than a broad emergency. The CVSS 4.0 vector shows AV:N and AC:L but crucially AT:P (an attack requirement must be met) and PR:L (a backend account is required), with impact limited to integrity and availability (VI:H/VA:H, VC:N) - consistent with an attacker who can destroy data and break the site but cannot read confidential data. CISA KEV status is not indicated in the input, so treat this as not actively exploited; no EPSS probability was provided, so widespread-exploitation likelihood cannot be quantified from the data. No PoC or exploit reference is present (only the fix commit and advisories), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the limiting precondition: a usable CSRF token is only issued on admin-restricted pages, so the realistic attacker is a demoted-but-still-logged-in former admin, or someone who stole the token via a separate flaw. Net: a real but targeted/insider-leaning risk with high destructive potential (dropping the structure addon's tables wipes articles), not a high-CVSS-but-inflated issue, though its exploitability is gated by unusual session conditions. Missing data: no EPSS, no KEV confirmation, no independent PoC.

A user who held admin rights earlier in the same still-valid backend session is demoted to a non-admin role; their session retains a valid CSRF token for rex_api_package. They send a crafted authenticated request to rex-api-call=package to uninstall the system 'structure' addon, whose uninstall routine drops its database tables and destroys all articles and content. No public exploit was identified; only the vendor fix commit is public.