GHSA-fw98-549m-whxx: REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

Published Oct 27, 2026

Updated

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade REDAXO core to a version that resolves this vulnerability.
Fixed in 5.21.5

Event History

Oct 27, 2026

CVE Published

via OSV·10:59 AM

Data Sourced

via OSV·10:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users could abuse this issue?

Non-admin backend users who possess a valid CSRF token could manage packages despite lacking administrator authorization. This can include demoted administrators whose sessions remain active and still provide a usable token.

What actions could an attacker perform after exploiting it?

An attacker could deactivate, install, activate, or delete non-system packages. They could also uninstall system addons such as structure, which can drop the addon's database tables.

How can I determine whether my installation is affected?

REDAXO core versions before 5.21.5 are affected. Review whether non-admin backend accounts have active sessions or valid CSRF tokens, particularly accounts that were recently demoted from administrator privileges.

GHSA-fw98-549m-whxx: REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

Remediation

Event History

Frequently Asked Questions

Which users could abuse this issue?

What actions could an attacker perform after exploiting it?

How can I determine whether my installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users could abuse this issue?

What actions could an attacker perform after exploiting it?

How can I determine whether my installation is affected?