CVE-2026-63000

MediumCVSS 6.4/10Last modified Oct 19, 2026

Description

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630014.8REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_ma CVE-2026-630024.8REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diff CVE-2026-630036.5django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication CVE-2026-630045.5Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the oper CVE-2026-630065.3Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets co CVE-2026-63018.8Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-630108.7Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-p CVE-2026-630119.4Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Con CVE-2026-630154.3Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issu CVE-2026-630165.3Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-offici CVE-2026-630179.0Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administra CVE-2026-630184.8Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software before version 1.16.18