Vulnerability Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
- https://github.com/redaxo/core/pull/6579
- https://github.com/redaxo/core/releases/tag/5.21.2
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
FAQ
What is CVE-2026-63000?
CVE-2026-63000 is a vulnerability with a CVSS score of 6.4 (MEDIUM). REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_fun...
How severe is CVE-2026-63000?
CVE-2026-63000 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63000?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.