Description
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle, or reorder live slices via content/functions, slice ids, content_slice_status, content_move_slice, history restore, or content_copy, bypassing approval workflows.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redaxo | core | < 5.21.6 | 5.21.6 |
References
- GitHub Security Advisory (GHSA-6w5f-mr8f-5964) vendor-advisory
- VulnCheck Advisory: REDAXO before 5.21.6 Authorization Bypass of Live Version Permission third-party-advisory