CVE-2026-116893 in core
Summary
by MITRE • 10/27/2026
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO core versions prior to 5.21.5 represents a critical failure in access control mechanisms within the application's backend interface. Specifically, the flaw resides in the rex_api_package API function, which is designed to handle package management operations such as installation, activation, deactivation, and uninstallation of addons. The root cause of this vulnerability is a missing authorization check that relies solely on the presence of a valid Cross-Site Request Forgery (CSRF) token for authentication rather than verifying the user's role or permissions. In secure web application architectures, CSRF tokens are intended to prevent unauthorized commands from being submitted by malicious sites, but they do not replace server-side access control checks. By omitting these essential authorization validations, the system inadvertently grants any authenticated session with a valid token the ability to execute administrative functions that should be restricted to users with specific high-level privileges.
This architectural oversight allows attackers who possess a valid CSRF token and an active backend session to manipulate package states without requiring administrator credentials. The impact is particularly severe for demoted administrators or other privileged users whose sessions remain active despite their role being downgraded from admin status. These individuals, often referred to as insider threats in this context, can exploit the vulnerability to perform destructive actions against the application's infrastructure. For instance, an attacker could uninstall core system addons such as structure, which is fundamental for managing content types and database schemas. The removal of such critical components results in the dropping of associated database tables, leading to immediate data loss or corruption that may be difficult or impossible to recover without backups.
Beyond the destruction of system integrity, the vulnerability enables a broader range of malicious activities including the installation of potentially harmful third-party packages, deactivation of security-related addons, and deletion of non-system packages. This level of control effectively compromises the confidentiality, integrity, and availability of the REDAXO instance. The ability to install arbitrary code through package manipulation introduces significant risks related to remote code execution or further privilege escalation if those packages contain malicious payloads. Furthermore, the disruption caused by deactivating essential modules can lead to service outages, impacting business operations and user experience for all visitors accessing the website hosted on this platform.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Control, as it involves an actor obtaining privileges that they are not entitled to hold. Additionally, the exploitation method falls under MITRE ATT&CK technique T1078, Valid Accounts, specifically when leveraged by demoted users or compromised sessions to maintain access and perform administrative actions. The reliance on CSRF tokens without supplementary authorization checks is a common anti-pattern in web development that underscores the importance of implementing defense-in-depth strategies where multiple layers of security controls are verified independently.
To mitigate this vulnerability, organizations running REDAXO versions earlier than 5.21.5 must upgrade to the patched version immediately. The fix involves reinforcing the rex_api_package API function with rigorous server-side authorization checks that verify the current user's role against a whitelist of allowed roles for each specific operation. Developers should ensure that all administrative endpoints enforce strict access control lists (ACLs) independent of session validity or CSRF token presence. Additionally, implementing short-lived sessions and automatic logout mechanisms for demoted users can reduce the window of opportunity for such attacks. Regular security audits focusing on API endpoint permissions are recommended to prevent similar misconfigurations in future development cycles.