REDAXO EUVD-2026-110795

Requires an authenticated REDAXO editor session with content permission on at least one category - this is the key limiting factor, confining exploitation to multi-editor installations and compromised/insider accounts rather than anonymous attackers. Per-path prerequisites from the vendor advisory: slice delete (content/edit function=delete) needs the module permission for the addressed slice's module, which defaults to 'all'; the content_slice_status API needs the global publishSlice[] permission; content_move_slice needs the global moveSlice[] permission plus the module permission for the addressed slice; slice edit/overwrite (content/edit function=edit) additionally requires a matching module/template constellation (the addressed slice's module must be allowed in the template and ctype of the attacker's own article), making overwrite the hardest effect to achieve. Delete and online/offline toggling need the fewest extra permissions and are the most direct effects. No victim, user interaction, or cross-site vector is required. Fixed in REDAXO 5.21.4 (vulnerable <= 5.21.3); updating is the remediation given by the vendor.

This is a moderate-priority, authenticated authorization flaw rather than a widespread emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N, VI:H, all other impacts N; 7.1) tells a consistent story: network-reachable, low complexity, no user interaction, but PR:L - the attacker must already hold a REDAXO editor account with content permission on at least one category, which bounds the threat to multi-editor installations and insider/compromised-account scenarios. No EPSS score was provided, the CVE is not listed in CISA KEV, and the only references are vendor/coordinator advisories (GitHub GHSA and VulnCheck) - no PoC or working exploit code is referenced. The vuln.today decision label is 'this_week', which aligns with a patch-available, non-actively-exploited integrity bug: act within the week, not immediately. One signal to verify: the vendor 4.0 vector sets VA:N, but the GHSA advisory text states both integrity AND availability of other editors' content are affected (deletion and de-activation) - treat the availability wording as integrity-of-data impact unless the vendor clarifies. Net: a real but scoped integrity issue for sites with multiple editors; low urgency for single-editor or single-author deployments.

An authenticated REDAXO editor who holds content permission on at least one category crafts a content/edit (function=delete or edit) request, or a call to the content_slice_status / content_move_slice API, that references an article they are allowed to edit while pointing the slice id at a slice in a category they cannot access. Because the permission check is evaluated against the request article but the mutation acts on the independent slice reference, REDAXO applies the change to the foreign slice, letting the attacker delete, toggle online/offline, move, or (with a matching module/template constellation) overwrite another editor's content. No public exploit identified at time of analysis; the attack needs no victim and no cross-site vector and runs entirely within the attacker's own authenticated session.