Cross-Site Request Forgery Vulnerability in REDAXO by REDAXO

CVE-2026-117536

What is CVE-2026-117536?

REDAXO versions below 5.21.3 are vulnerable to a cross-site request forgery (CSRF) attack in the backend user administration page. The vulnerability arises because the CSRF token verification only activates when the save parameter is set. This oversight allows threat actors to exploit the update path, initiated by FUNC_UPDATE, without requiring the CSRF token. By crafting a malicious GET link, attackers can deceive users with backend permissions into executing unauthorized actions, such as granting themselves administrator rights, deactivating user accounts, or locking out the primary administrator.

References