CVE-2026-63000: REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

September 23, 2026

The rex_api_install_package_update API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rex_api_function. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

References

github.com/advisories/GHSA-m8r3-22v6-g877
github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
github.com/redaxo/core/pull/6579
github.com/redaxo/core/releases/tag/5.21.2
github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
nvd.nist.gov/vuln/detail/CVE-2026-63000

Code Behaviors & Features

Detect and mitigate CVE-2026-63000 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →