Vulnerability-Lookup

CVE-2026-63000 (GCVE-0-2026-63000)

Vulnerability from cvelistv5 – Published: 2026-09-23 14:08 – Updated: 2026-09-23 14:08

Title

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/redaxo/core/security/advisorie…	x_refsource_CONFIRM
https://github.com/redaxo/core/pull/6579	x_refsource_MISC
https://github.com/redaxo/core/commit/a13abbffbad…	x_refsource_MISC
https://github.com/redaxo/core/releases/tag/5.21.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
redaxo	core	Affected: < 5.21.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator\u0027s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator\u0027s intent. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:08:42.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6579",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6579"
        },
        {
          "name": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-m8r3-22v6-g877",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63000",
    "datePublished": "2026-09-23T14:08:42.402Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:08:42.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "core",
                "vendor": "redaxo",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.21.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator\u0027s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator\u0027s intent. This issue is fixed in version 5.21.2."
          }
        ],
        "id": "CVE-2026-63000",
        "lastModified": "2026-09-23T18:12:04.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-23T15:17:15.453",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/redaxo/core/pull/6579"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-63000

Vulnerability from fkie_nvd - Published: 2026-09-23 15:17 - Updated: 2026-09-23 18:12

Severity

6.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
	security-advisories@github.com	https://github.com/redaxo/core/pull/6579
	security-advisories@github.com	https://github.com/redaxo/core/releases/tag/5.21.2
	security-advisories@github.com	https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator\u0027s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator\u0027s intent. This issue is fixed in version 5.21.2."
    }
  ],
  "id": "CVE-2026-63000",
  "lastModified": "2026-09-23T18:12:04.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-23T15:17:15.453",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/pull/6579"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-M8R3-22V6-G877

Vulnerability from github – Published: 2026-09-23 14:09 – Updated: 2026-09-23 14:09

Summary

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Details

Summary

The rex_api_install_package_update API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rex_api_function. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

Details

File: redaxo/src/core/lib/api_function.php:277-280

protected function requiresCsrfProtection()
{
    return false;  // DEFAULT — subclasses must opt in
}

File: redaxo/src/addons/install/lib/api/api_package_update.php:8-39

class rex_api_install_package_update extends rex_api_function
{
    public function execute()
    {
        if (!rex::getUser()?->isAdmin()) {
            throw new rex_api_exception('You do not have the permission!');
        }
        $addonkey = rex_request('addonkey', 'string');
        $fileId = rex_request('file', 'int');
        $installer = new rex_install_package_update();
        // ... downloads and installs $addonkey version $fileId from redaxo.org
    }
    // requiresCsrfProtection() NOT overridden — defaults to false
}

For comparison, rex_api_install_package_add and rex_api_install_package_delete both correctly return true. Only rex_api_install_package_update is missing this.

PoC

<!-- Attacker-controlled page -->
<img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=install_package_update&addonkey=some_addon&file=42" />

When an authenticated admin visits this page, the request is automatically made with their session cookie, causing some_addon to be updated to version file_id=42.

Impact

An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.

Fix

Add requiresCsrfProtection() to rex_api_install_package_update:

protected function requiresCsrfProtection()
{
    return true;
}

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.21.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "redaxo/source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T14:09:15Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.\n\n### Details\n**File:** `redaxo/src/core/lib/api_function.php:277-280`\n```php\nprotected function requiresCsrfProtection()\n{\n    return false;  // DEFAULT \u2014 subclasses must opt in\n}\n```\n\n**File:** `redaxo/src/addons/install/lib/api/api_package_update.php:8-39`\n```php\nclass rex_api_install_package_update extends rex_api_function\n{\n    public function execute()\n    {\n        if (!rex::getUser()?-\u003eisAdmin()) {\n            throw new rex_api_exception(\u0027You do not have the permission!\u0027);\n        }\n        $addonkey = rex_request(\u0027addonkey\u0027, \u0027string\u0027);\n        $fileId = rex_request(\u0027file\u0027, \u0027int\u0027);\n        $installer = new rex_install_package_update();\n        // ... downloads and installs $addonkey version $fileId from redaxo.org\n    }\n    // requiresCsrfProtection() NOT overridden \u2014 defaults to false\n}\n```\n\nFor comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true`. Only `rex_api_install_package_update` is missing this.\n\n### PoC\n```html\n\u003c!-- Attacker-controlled page --\u003e\n\u003cimg src=\"https://victim-redaxo.example.com/index.php?page=install/packages\u0026rex-api-call=install_package_update\u0026addonkey=some_addon\u0026file=42\" /\u003e\n```\nWhen an authenticated admin visits this page, the request is automatically made with their session cookie, causing `some_addon` to be updated to version `file_id=42`.\n\n### Impact\nAn attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.\n\n### Fix\nAdd `requiresCsrfProtection()` to `rex_api_install_package_update`:\n```php\nprotected function requiresCsrfProtection()\n{\n    return true;\n}\n```",
  "id": "GHSA-m8r3-22v6-g877",
  "modified": "2026-09-23T14:09:15Z",
  "published": "2026-09-23T14:09:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/pull/6579"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redaxo/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63000 (GCVE-0-2026-63000)

FKIE_CVE-2026-63000

GHSA-M8R3-22V6-G877

Summary

Details

PoC

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour