Skip to content
Fencer Vulns
medium 6.4

CVE-2026-63000 json

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

published 2026-09-23 47 d ago modified 2026-10-19 20 d ago also GHSA-m8r3-22v6-g877 , EUVD-2026-85308

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Patch / fix

  • packagist redaxo/source 5.21.2
  • redaxo redaxo 5.21.2

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
41 d ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
GitHub 3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Affected packages

ecosystem package affected fixed in
packagist redaxo/source
<5.21.2
5.21.2

Affected products

  • redaxo core

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.