CVE-2026-63000: REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

September 23, 2026

The rex_api_install_package_update API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rex_api_function. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

References

github.com/advisories/GHSA-m8r3-22v6-g877
github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
github.com/redaxo/core/pull/6579
github.com/redaxo/core/releases/tag/5.21.2
github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
nvd.nist.gov/vuln/detail/CVE-2026-63000

Code Behaviors & Features

Detect and mitigate CVE-2026-63000 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →