Login Request a demo
Medium severity · published Sep 23, 2026
CVE-2026-63000
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
6.4
CVSS
0.1%
EPSS
No
On KEV
Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · redaxo
< 5.21.2 · source: vendor
RE
Redaxo · Redaxo
before 5.21.2 · source: NVD
Affected product
CO
core
redaxo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-63000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-63000
x_refsource_CONFIRM
https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
x_refsource_MISC
https://github.com/redaxo/core/pull/6579
x_refsource_MISC
https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
x_refsource_MISC
https://github.com/redaxo/core/releases/tag/5.21.2
More from core
9.8
CVE-2026-117532
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
8.8
CVE-2026-117536
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
7.5
CVE-2026-116896
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
7.5
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
7.1
CVE-2026-116898
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move