CVE-2026-116893: REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXO coreto a version that resolves this vulnerability.Fixed in 5.21.5
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Non-admin REDAXO backend users are affected if they possess a valid CSRF token. The advisory specifically notes demoted administrators with active sessions as an example of users who may retain such a token.
What actions could an attacker perform after exploiting it?
An attacker could deactivate, install, or activate packages; delete non-system packages; and uninstall system add-ons. Uninstalling the structure add-on can drop its database tables.
Is user interaction required for exploitation?
No. The provided CVSS vector indicates UI:N, but exploitation requires low-level privileges as a backend user and a valid CSRF token.
What version addresses the vulnerability?
The issue affects REDAXO core versions before 5.21.5. Updating to 5.21.5 or later addresses the affected version range described.