---
id: CVE-2016-20053
title: >-
  Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows
  unauthenticated attackers to create administrative user accounts by tricking
  authenticated administrators into visiting malicious pages
summary: >-
  Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows
  unauthenticated attackers to create administrative user accounts by tricking
  authenticated administrators into visiting malicious pages. Attackers can
  craft H…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
vendor: redaxo
product: redaxo
affected:
  - redaxo = 5.2
published: '2026-04-04'
updated: '2026-07-21'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-20053'
references:
  - url: 'https://www.exploit-db.com/exploits/40708'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/redaxo-cms-cross-site-request-forgery-via-users-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00146
epssPercentile: 0.0427
ingestedAt: '2026-07-21T16:51:40.963Z'
---

## Overview

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

## Affected

- `redaxo = 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.