https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T21:22:07.214629+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116893 fkie_cve-2026-116893 2026-10-28T21:22:07.234227+00:00

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.

 https://db.gcve.eu/vuln/ghsa-hcxm-g8rr-hmvw GHSA-hcxm-g8rr-hmvw 2026-10-28T21:22:07.234297+00:00

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.