CVE-2026-117536 Details
Description
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
A cross-site request forgery (CSRF) vulnerability has been identified in REDAXO versions prior to 5.21.3. The issue resides in the backend user administration page, specifically under 'users/users'. The vulnerability arises because the CSRF token validation only occurs when the 'save' parameter is present. In contrast, the update process, triggered by 'FUNC_UPDATE', bypasses this requirement. This flaw allows attackers to manipulate logged-in users with 'users[]' permissions into clicking a crafted GET link, which could result in unauthorized administrative rights, deactivating user accounts, or locking out the sole administrator.
Users can upgrade to REDAXO version 5.21.3 or later, where this vulnerability has been fixed. The update process should be followed according to the official REDAXO documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/redaxo/core/security/advisories/GHSA-mrrj-4f5x-j958 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/redaxo-before-5.21.3-csrf-token-bypass-via-users-users-privilege-escalation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| REDAXO | <= 5.21.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |