REDAXO Core Missing Authorization in Package Management

Executive Summary

CVE-2026-116893 is a missing authorization vulnerability in REDAXO core versions before 5.21.5. It affects the rex_api_package API function, which manages package operations like install, uninstall, activate, deactivate, and delete. The flaw allows non-admin backend users with a valid CSRF token to perform unauthorized package management actions.

Useful 0 Not Useful 0

Detection Guidance

Check REDAXO core version with: grep -r "REDAXO_VERSION" /path/to/redaxo/core. If version is below 5.21.5, the system is vulnerable. Review API logs for unauthorized package management actions like uninstall, deactivate, install, activate, or delete.

Inspect rex_api_package function in api_package.php for missing admin permission checks. Look for non-admin users executing package operations with valid CSRF tokens.

Useful 0 Not Useful 0

Impact Analysis

Attackers with a valid CSRF token can uninstall system addons (dropping database tables), deactivate critical packages, install or activate malicious packages, or delete non-system packages. This could lead to data loss, system compromise, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO core to version 5.21.5 or later immediately. Verify admin permission checks are enforced in rex_api_package function. Revoke and regenerate all CSRF tokens to invalidate any potentially compromised sessions.

Audit package management logs for unauthorized actions. Remove non-admin user access to backend package management features until patched.

Useful 0 Not Useful 0