CVE-2026-63000
mediumREDAXO is a PHP-based content management system.
Vendor / product: Redaxo — redaxo
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
CVSS
6.4
6.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-23 15:17
Modified: 2026-10-19 20:35
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:55 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
redaxo / redaxo <5.21.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
Patch / mitigation: https://github.com/redaxo/core/pull/6579
References
- https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3 security-advisories@github.com
- https://github.com/redaxo/core/pull/6579 security-advisories@github.com
- https://github.com/redaxo/core/releases/tag/5.21.2 security-advisories@github.com
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 security-advisories@github.com
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗