Cross-Site Request Forgery in REDAXO by REDAXO
CVE-2026-116895

5.1MEDIUM

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116895?

A CSRF vulnerability exists in REDAXO prior to version 5.21.5, allowing unauthorized changes to be made by attackers. Specifically, the backend processes the safemode GET parameter in index.php without proper validation of CSRF tokens. This flaw can be exploited by an attacker who tricks a logged-in administrator into following a malicious link, potentially leading to the disabling of global safe mode or altering backend settings. It is crucial for users to update to the latest version to mitigate this risk.

Affected Version(s)

core 0 < 5.21.5

core 5.21.5

References

https://github.com/redaxo/core/security/advisories/GHSA-4...
vendor-advisory
https://www.vulncheck.com/advisories/redaxo-before-5.21.5...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
AlpetGexha
manus-use
.