What is CVE-2026-63000?

CVE-2026-63000 is a medium-severity vulnerability in Redaxo Core, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.4/10. Published 2026-09-23.

How severe is CVE-2026-63000?

Medium severity. CVSS v3 base score is 6.4 out of 10.

CSRF in Redaxo Core

CVE-2026-63000

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2026-09-23 · last modified 2026-09-23.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Redaxo Core — versions < 5.21.2

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

Frequently asked questions

What is CVE-2026-63000?: CVE-2026-63000 is a medium-severity vulnerability in Redaxo Core, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.4/10. Published 2026-09-23.
How severe is CVE-2026-63000?: Medium severity. CVSS v3 base score is 6.4 out of 10.