{"id":"CVE-2026-63000","title":"REDAXO is a PHP-based content management system","summary":"REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() inste…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","cwe":["CWE-352"],"vendor":"redaxo","product":"core","affected":["core < 5.21.2"],"patched":["redaxo/source 5.21.2"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:12:04.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63000","references":[{"url":"https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/pull/6579","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-m8r3-22v6-g877"}],"tags":["nvd","cve.org","ghsa","composer"],"aliases":["GHSA-m8r3-22v6-g877"],"ecosystem":"composer","ingestedAt":"2026-09-23T14:25:29.804Z","epss":0.00131,"epssPercentile":0.02192,"slug":"CVE-2026-63000","body":"## Overview\n\nREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63000)\n\nAffected packages:\n\n- `redaxo/source <= 5.21.1`\n\nPatched in:\n\n- `redaxo/source 5.21.2`\n\nSource: https://github.com/advisories/GHSA-m8r3-22v6-g877","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}