CVE-2026-62998: REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

The rex_list component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable(). Although the value is wrapped in backticks via escapeIdentifier() (preventing classical SQL injection), this still allows any authenticated backend user to ORDER BY any column in the query’s FROM tables, including unselected sensitive columns such as password from the rex_user table, and perform error-based column enumeration.