REDAXO Core CVE-2026-117532

Exploitation requires that the bundled structure/history plugin is installed AND activated - it is not enabled by default, which is the primary limiting factor and narrows the exposed population. The attacker must also know or enumerate a valid backend login name, but the advisory notes 'admin' is a common default and names are enumerable, so this is a weak barrier and the issue should be treated as exploitable without prior account knowledge. The authentication bypass itself needs no valid session or prior access (PR:N confirmed by the CVSS vector). The escalation to remote code execution additionally requires that the instance is NOT running in live mode, because live mode disables the template/module/action editing and package-management functions used to introduce PHP; in live mode the backend session compromise still occurs but the RCE pivot does not apply.

This is a genuine high-priority issue, not an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes an unauthenticated, network-reachable, low-complexity authentication bypass yielding full compromise of the affected system, and the vendor advisory corroborates the mechanism: the session-tied secret can be forced into a predictable state without authenticating, after which a temporary login token for any known account (e.g. admin) can be forged. The vuln.today decision label is act_now, which aligns with the CVSS severity and the vendor's own description of unauthenticated admin takeover. Two signals temper the raw score, and they should be stated explicitly: (1) exploitation is gated on a non-default condition - only installations with the structure/history plugin installed AND activated are affected - so the real-world exposed population is a subset of REDAXO deployments; and (2) the RCE pivot applies only when the instance is NOT running in live mode, because live mode disables the template/module/add-on editing paths. No EPSS score was provided, so exploitation probability cannot be quantified here. This is NOT in CISA KEV and no confirmed working exploit code is present in the inputs (only vendor/NVD advisories), so there is no evidence of active exploitation yet - but the low attack complexity, unauthenticated reach, weak admin-enumeration precondition, and act_now label make prompt patching appropriate.

An unauthenticated attacker reaches the frontend of a REDAXO site that has the structure/history plugin activated, forces the session-tied secret into a known predictable state, and forges a temporary login token for the 'admin' account using only attacker-controlled inputs. This grants a backend administrator session; on an instance not running in live mode the attacker then introduces executable PHP via templates, modules, actions, or an add-on install to achieve server-side code execution. No confirmed public exploit code is present in the supplied data (references are vendor and NVD advisories only), and the low complexity of the forgery makes the chain practical.