REDAXO CMS CVE-2026-116898

Requires an authenticated REDAXO backend user who has media permission for at least one category, plus at least one file existing in another (restricted) media category. No crafted request or victim interaction is needed: because media permissions are flat and a search - especially searchmode=global - lists files outside the user's permitted categories, those files appear as selectable checkboxes, so entering a search term, ticking a foreign file and pressing move is enough. CSRF protection does not help because the attacker is the legitimately logged-in user. Limiting factors beyond the raw score: backend authentication is mandatory (PR:L), and the resulting file replacement is constrained - the new file's extension must match the original (or jpg/jpeg), the MIME allowlist applies, and SVGs are sanitised; deletion of in-use files is refused outright.

Signals are consistent and point to a moderate, integrity-focused priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable backend flaw with low complexity but requiring an authenticated backend user (PR:L), so this is not an unauthenticated internet-facing bug. Impact is skewed to integrity (VI:H) with only low confidentiality (VC:L) and no availability impact, matching the advisory's point that media confidentiality is already weak by design and that deletion is blocked for in-use files. CISA KEV status is NO and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - so there is no active-exploitation signal and the issue is not mass-automatable (it requires an existing authenticated session and some interaction). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared here. The vuln.today decision label is 'this_week', which aligns with a real but non-emergency priority: patch within the normal weekly cycle. This is a genuine privilege/authorization weakness, not an inflated high-CVSS-but-low-real-risk issue, but its need for valid backend credentials and the constraints on file replacement (extension match, MIME allowlist, SVG sanitisation) bound the real-world blast radius.

An authenticated REDAXO backend user who holds media permission for just one category runs a search (notably with searchmode=global), which surfaces files from categories they are not authorised for as selectable. They tick a restricted file, bulk-move it into their own category - which only checks the target category permission - and then use the media detail 'replace file' function to silently overwrite a logo, PDF or download embedded across the whole site. No public exploit is identified at time of analysis, but the advisory confirms no crafted request is needed: searching, ticking and pressing move is sufficient.