A critical authentication bypass affects the structure/history plugin in REDAXO core. Versions from 5.3.0 up to, but not including, 5.21.4 are vulnerable. An unauthenticated attacker can forge temporary login tokens and get into the backend.
What Is It
CVE-2026-117532 is an authentication bypass (CWE-287, Improper Authentication) in the structure/history plugin of REDAXO core. The NVD record says an attacker can force a secret tied to the session into a predictable state. The attacker can then forge temporary login tokens for accounts such as admin.
VulnCheck disclosed the issue, and NVD published it on 2026-10-27. Its NVD status is currently "Received," which means NVD has not yet finished its own analysis.
Why It Matters
VulnCheck scores the flaw 9.8 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The vectors describe an attack that:
- works over the network,
- has low attack complexity,
- needs no privileges,
- needs no user interaction.
A successful attack gives the attacker backend access as a forged account, including admin. The NVD description states that this can lead to code execution outside live mode. The impact on confidentiality, integrity and availability is high.
Exploitation status: This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation at this time. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: REDAXO
- Product: core
- Affected versions: 5.3.0 up to, but not including, 5.21.4
- Unaffected: 5.21.4
- Component: structure/history plugin
The NVD record does not list any CPEs yet.
Patch Status
The affected-version data lists REDAXO core 5.21.4 as unaffected, so upgrading to 5.21.4 or later fixes the issue. Administrators running any release from 5.3.0 up to, but not including, 5.21.4 should upgrade. The attack needs no authentication, so upgrade internet-facing REDAXO backends first.
There is no CISA KEV entry, so no federal remediation deadline or required action applies. See the vendor's GitHub security advisory for full fix details and any interim guidance.