CVE-2026-117536: REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNCUPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXOto a version that resolves this vulnerability.Fixed in 5.21.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
A REDAXO backend user must be logged in and have the users[] permission. An attacker can target that user by persuading them to open a crafted GET link.
What can an attacker do if exploitation succeeds?
The attacker can cause changes in backend user administration, including granting administrator rights, deactivating accounts, or locking out the sole administrator. The attack does not require the attacker to authenticate to REDAXO.
Which versions are affected?
REDAXO versions before 5.21.3 are affected. The issue is in the backend users/users administration page.
What is the immediate mitigation if upgrading is not possible?
Limit access to backend accounts with the users[] permission and avoid opening untrusted links while authenticated to the REDAXO backend. This reduces the opportunity for a crafted GET request to be executed in an authenticated administrator session.