Live › vulnerability › CVE-2026-117536
Go to dashboardREDAXO versions before 5.21.3 check the CSRF token on the backend user administration page only when the save parameter is set, so the update path can be triggered without it. An attacker who lures a logged-in backend user with user-management permission to a crafted GET link can grant administrator rights, deactivate accounts, or lock out the sole administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO before 5.21.3 with backend users who hold the users[] permission are exposed, because the attack needs a logged-in backend user to follow a link. Sites where only administrators use the backend still carry risk from any user with that permission. Sites already on 5.21.3 or later are not affected.
No product ranges from the sources yet.
5.21.2 or older is affected per the advisory.5.21.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-117536")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.