Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-62998REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Medium 4.3

In plain English

A medium-severity improper input validation in core from redaxo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	redaxo/source	5.21.2	GHSA-4f5f-j737-pm58

Affected products (as reported)

Vendor	Product	Versions
redaxo	core	< 5.21.2

Weakness: CWE-20, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 x_refsource_CONFIRM
https://github.com/redaxo/core/pull/6580 x_refsource_MISC
https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd x_refsource_MISC
https://github.com/redaxo/core/releases/tag/5.21.2 x_refsource_MISC