CVE-2026-117536
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user…
- Risk score
- 58/100
- CVSS
- 8.8 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the …
- Affected
- See advisory
- Fix
- Upgrade the product to 5.21.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
Last activity 27 Oct 2026. Patch Forecast updates every hour.