CVE-2026-116896 — REDAXO before 5.21.5: Privilege Escalation via Backup Export of Authentication Tables

REDAXO versions before 5.21.5 contain a missing authorization vulnerability in the backup add-on export function. Non-admin users with the backup[export] permission can export rex_user, rex_user_session, and other applications' tables.