CVE-2026-63000 in REDAXO
Summary
by MITRE • 09/23/2026
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in REDAXO content management systems prior to version 5.21.2 represents a critical failure in access control mechanisms, specifically concerning Cross-Site Request Forgery protections within the administrative interface. The core technical flaw resides in the rex_api_install_package_update class located at redaxo/src/addons/install/lib/api/api_package_update.php. This component is responsible for handling requests to update or install packages from configured repositories. However, it incorrectly inherits a default configuration value of false from its parent class, rex_api_function::requiresCsrfProtection(). In secure web application architecture, administrative actions that modify system state must require explicit validation tokens to ensure the request originates from an authorized user interface rather than a malicious external source. By inheriting this false default without overriding it to true, the API endpoint fails to enforce CSRF token verification during package update operations.
This architectural oversight allows unauthenticated attackers to exploit the vulnerability through crafted HTTP requests that mimic legitimate administrative actions. When a logged-in administrator with sufficient privileges visits a maliciously constructed webpage or clicks on a manipulated link, their browser will automatically include session cookies and credentials in subsequent requests to the REDAXO server. Because the package update endpoint does not validate these tokens, the server accepts the request as valid. The attacker can thus force the administration panel to initiate downloads from configured package servers, leading to the installation or updating of arbitrary addons without the administrator's knowledge or consent. This bypasses standard security controls designed to prevent unauthorized state changes via social engineering or drive-by attacks.
The operational impact of this vulnerability is severe due to the high-privilege nature of the affected action. Successful exploitation enables an attacker to compromise the integrity of the content management system by injecting malicious code through compromised or specially crafted packages available on public package servers. This can result in full server takeover, data exfiltration, defacement, or complete disruption of service availability. Since REDAXO is often used for enterprise and institutional websites, such a breach could lead to significant reputational damage and regulatory non-compliance regarding data protection standards. The ability to silently alter installed addon code means that persistent backdoors can be established, allowing long-term unauthorized access even after the initial exploitation vector is mitigated.
To mitigate this risk, organizations running REDAXO versions prior to 5.21.2 must immediately upgrade to version 5.21.2 or later where the requiresCsrfProtection method has been correctly overridden to enforce token validation for package management operations. For systems that cannot be upgraded instantly due to compatibility constraints, temporary mitigations include restricting access to the administrative interface via IP whitelisting and ensuring that no public-facing web servers can reach the admin endpoints directly without additional authentication layers such as two-factor authentication or network-level firewalls. Additionally, monitoring server logs for unusual package installation activities can help detect potential exploitation attempts in real-time.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery (CSRF), which describes the failure to verify that an action was intentionally initiated by the user. It also maps to ATT&CK technique T1078 Valid Accounts, as it involves abusing legitimate administrative credentials through automated requests rather than credential theft. Furthermore, the potential for installing malicious addons relates to CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-269 Improvement of Privileges if the installed package escalates access rights. Adhering to these industry standards ensures that future development practices prioritize explicit security checks over inherited defaults, particularly in API endpoints handling sensitive state-changing operations.