REDAXO Core EUVD-2026-110793

Prerequisites are concrete. Working-version preview (structure/version, rex_version=1): requires only any live backend PHP session - gated solely by rex_backend_login::hasSession(), which does not run checkLogin(), so even a media-pool-only account with no structure permission, and even a deactivated user whose session still exists, can read the working version of any article in any language. History preview (structure/history, rex_history_date=…): requires the global history[article_rollback] permission but still ignores the target article's category and clang, exposing snapshots (including deleted content) outside the user's mountpoint. Both paths require the respective plugin to be installed and activated (both ship with core and are enabled by default) and a working version or snapshot to exist for the target article. LIMITING factors: a valid authenticated backend session is mandatory (no unauthenticated exploitation), impact is confined to confidentiality, and only REDAXO core before 5.21.4 is affected; no victim interaction or cross-site vector is involved.

Signals point to a genuine but moderate priority. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 (High): network-reachable, low complexity, no user interaction, but it requires privileges (PR:L) - i.e. an authenticated backend account - and impacts confidentiality only (VC:H; VI:N/VA:N). The GHSA advisory confirms this is a missing-authorization/broken-access-control issue (CWE-862, CWE-200), not an unauthenticated flaw. No CISA KEV listing is present in the input and no EPSS score was provided, so exploitation-probability signals are absent rather than low - treat them as unknown. No working exploit code is referenced (the two advisories are write-ups, not PoC code), so this is: no public exploit identified at time of analysis. The vendor priority Decision label is 'this_week', consistent with a patched, authenticated-only confidentiality bug that is nonetheless systematically enumerable. Net: this is a real issue warranting prompt patching within the week, but it is not a drop-everything emergency - the authenticated-only prerequisite (PR:L) and confidentiality-only impact meaningfully limit real-world blast radius compared with the raw High score. The main aggravating factor is that both previews can be enumerated over article_id and clang, turning a single-object leak into systematic exposure of all unpublished, historic, and deleted content.

A low-privilege backend user - even an account created only for the media pool with no structure permission at all - sends an ordinary frontend request appending rex_version=1 with an arbitrary article_id to render and read the unpublished working version of any article in any language; an editor additionally holding history[article_rollback] sets rex_history_date to read historic and previously-deleted snapshots outside their mountpoint. No public exploit code is referenced (only vendor/VulnCheck advisories), and with AV:N/AC:L/UI:N the request is trivial to issue once a backend session exists. No victim interaction or cross-site vector is needed.