REDAXO Core: CSRF token bypass in user administration allows privilege escalation
Summary
REDAXO before 5.21.3 contains a cross-site request forgery flaw in the backend user administration page (users/users). The CSRF token check is only performed when the save parameter is set, but the update path triggered by FUNC_UPDATE does not require it. An attacker can lure a logged-in backend user with users[] permission to a crafted GET link to grant administrator rights, deactivate accounts or lock out the only administrator.
Affected
- REDAXO Core before 5.21.3 (affected range 0 to < 5.21.3 per CNA; VulDB lists up to 5.21.2)
Fixed in
- Fixed in REDAXO Core 5.21.3 (released 31 July 2026)
- Latest release at time of writing: 5.21.5, which also fixes further security issues
Workaround
- Unknown. No workaround is documented in the sources; upgrading is the fix.
Exploitation
- Not listed in CISA KEV.
- No public exploit or proof of concept found in the sources reviewed; the primary advisory could not be retrieved, so one cannot be ruled out.
- VulDB rates exploitability as easy.
Our recommendation
- Inventory all REDAXO instances and the installed users addon version.
- Update REDAXO Core to 5.21.5 (at least 5.21.3) and update addons according to the release notes.
- Review administrator accounts and users[] rights for unexpected changes and check for recently deactivated accounts.
- Restrict backend access via VPN or IP allowlist where practical.
- Limit the users[] permission to the fewest accounts and avoid browsing external links while logged into the backend.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mrrj-4f5x-j958 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB 427152 vuldb.com
- REDAXO 5.21.3 changelog (mirror) newreleases.io
- REDAXO 5.21.4 release github.com
- REDAXO 5.21.5 release github.com
- Strix CVE-2026-117536 www.strix.ai
- OffSeq radar CVE-2026-117536 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:02.
Original description (NVD)
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.