Medium severity · published Sep 23, 2026
CVE-2026-62998
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · redaxo
< 5.21.2 · source: vendor
RE
Redaxo · Redaxo
before 5.21.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62998
Patch
https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd
Issue Tracking
https://github.com/redaxo/core/pull/6580
Release Notes
https://github.com/redaxo/core/releases/tag/5.21.2
Exploit
https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58
More from core
9.8
CVE-2026-117532
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
8.8
CVE-2026-117536
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
7.5
CVE-2026-116896
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
7.5
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
7.1
CVE-2026-116898
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move