Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-117536REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
High 8.8
In plain English
A high-severity cross-site request forgery in core from redaxo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-mrrj-4f5x-j958) vendor-advisory
- VulnCheck Advisory: REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation third-party-advisory