---
id: "CVE-2026-117536"
kind: "vulnerability"
aliases: ["CVE-2026-117536"]
title: "REDAXO: backend user page lets a crafted link change account rights"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cms", "other", "php", "redaxo", "self-hosted"]
not_affected_if: ["no-users-permission-backend-users", "upgraded-to-5.21.3"]
published_at: "2026-10-27T11:17:34+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:31:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117536", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# REDAXO: backend user page lets a crafted link change account rights

REDAXO versions before 5.21.3 check the CSRF token on the backend user administration page only when the save parameter is set, so the update path can be triggered without it. An attacker who lures a logged-in backend user with user-management permission to a crafted GET link can grant administrator rights, deactivate accounts, or lock out the sole administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the backend or in the core version file; `5.21.2` or older is affected per the advisory.
- Review the backend user admin page (users/users) for the update path that accepts GET requests with FUNC_UPDATE.

## Fix

- Upgrade REDAXO to `5.21.3` or later.
- Until upgraded, restrict backend access to trusted users and avoid having users with the users[] permission browse untrusted links while logged in.

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117536

## From the sources

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_