CVE-2026-63000

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

• CWE-352

• https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
• https://github.com/redaxo/core/pull/6579
• https://github.com/redaxo/core/releases/tag/5.21.2
• https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62995joserfc is a Python library that provides an implementation …2.3
• CVE-2026-62996Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62997Kedro-Datasets provides data connectors for Kedro. From vers…7.7
• CVE-2026-62998REDAXO is a PHP-based content management system. Prior to 5.…4.3
• CVE-2026-62999Copier is a library and CLI app for rendering project templa…7.5
• CVE-2026-6300Use after free in CSS in Google Chrome prior to 147.0.7727.1…8.8
• CVE-2026-63001REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63002REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63003django CMS is an easy-to-use and developer-friendly enterpri…6.5
• CVE-2026-63004Unleash is an open-source feature management platform. Prior…5.5
• CVE-2026-63006Zammad is a web based open source helpdesk/customer support …5.3
• CVE-2026-6301Type Confusion in Turbofan in Google Chrome prior to 147.0.7…8.8