REDAXO CVE-2026-116896

Exploitation requires an authenticated REDAXO user account that an administrator has explicitly granted the backup[export] permission - by default only admins can access the backup addon, so this is a non-default role delegation (reflected in PR:L). With that permission, the user can select and export otherwise-sensitive tables (rex_user, rex_user_session, rex_user_passkey, rex_config, and tables of other applications sharing the same database), which are only deselected-by-default, not blocked, in versions <= 5.21.4. Limiting factors: full admin takeover via session hijack additionally requires that a victim admin currently has an active session or a stay-logged-in key stored in rex_user_session (the AT:P attack requirement); otherwise the attacker is limited to exporting password hashes for offline cracking. Admins themselves are not affected since they already have full access, and the issue is moot if backup[export] is granted only to trusted/admin users.

This is a real, actionable privilege-escalation issue but not an internet-wide emergency, and the signals are mostly consistent. The source CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 (High): network-reachable, low complexity, but requiring an attack condition (AT:P) and existing low privileges (PR:L) - i.e. an authenticated non-admin account that an admin explicitly granted the backup[export] permission. This is a non-default configuration, which meaningfully narrows the exposed population versus the 'AV:N' impression. Exploitation status is 'no public exploit identified at time of analysis' - the two references are vendor/VulnCheck advisories, not exploit code, and no EPSS score or CISA KEV entry is present in the input, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_week', consistent with a patched, authenticated-but-high-impact flaw rather than 'act_now'/'emergency'. Bottom line: prioritize patching where REDAXO is deployed and the backup[export] permission has been delegated to non-admins; where only admins hold that permission, the issue is not exploitable (admins already have full access). The main caveat is that the impact scoring (VI:H/VA:H) reflects the downstream admin takeover, not a direct integrity/availability write in the export feature itself, which is purely a disclosure of authentication tables.

An admin delegates the REDAXO backup[export] permission to a lower-privileged editor role. That editor opens Backup > Export, selects the rex_user_session table (offered but merely deselected by default), and exports it, obtaining plaintext session ids and stay-logged-in keys; they replay an admin's session id to take over the admin account without the password, or export rex_user to crack admin password hashes offline. No public exploit code is identified, and the session-hijack path requires an admin session or stay-logged-in key to currently exist (AT:P).