CVE-2026-63000: CWE-352: Cross-Site Request Forgery (CSRF) in redaxo core
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
AI Analysis
Technical Summary
REDAXO, a PHP-based CMS, had a CSRF vulnerability in the rex_api_install_package_update function because it inherited a false default from rex_api_function::requiresCsrfProtection(), failing to require a CSRF token. This allowed attackers to trick authenticated administrators into making unintended package update requests to the REDAXO package server, which could alter installed addon code or disrupt the site. The vulnerability is resolved in REDAXO version 5.21.2.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to cause a logged-in administrator's browser to perform unauthorized package updates. This can lead to modification of installed addon code or disruption of the website's operation. The confidentiality impact is low, integrity impact is high, and availability impact is low according to the CVSS vector.
Mitigation Recommendations
Upgrade REDAXO core to version 5.21.2 or later, where this CSRF vulnerability has been fixed. No other specific mitigations are indicated.
CVE-2026-63000: CWE-352: Cross-Site Request Forgery (CSRF) in redaxo core
Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
CVSS v3.1
Score 6.4medium
Affected software
redaxo
core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
REDAXO, a PHP-based CMS, had a CSRF vulnerability in the rex_api_install_package_update function because it inherited a false default from rex_api_function::requiresCsrfProtection(), failing to require a CSRF token. This allowed attackers to trick authenticated administrators into making unintended package update requests to the REDAXO package server, which could alter installed addon code or disrupt the site. The vulnerability is resolved in REDAXO version 5.21.2.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to cause a logged-in administrator's browser to perform unauthorized package updates. This can lead to modification of installed addon code or disruption of the website's operation. The confidentiality impact is low, integrity impact is high, and availability impact is low according to the CVSS vector.
Mitigation Recommendations
Upgrade REDAXO core to version 5.21.2 or later, where this CSRF vulnerability has been fixed. No other specific mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T23:10:57.032Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3e330f7a7c54106ea7c6c
Added to database: 09/23/2026, 14:33:20 UTC
Last enriched: 09/23/2026, 14:48:06 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.