{"vulnerability": "cve-2026-63000", "sightings": [{"uuid": "6c616b96-0d5e-4e63-a3ae-0f8dd0a22e56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63000", "type": "published-proof-of-concept", "source": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877", "content": "", "creation_timestamp": "2026-09-23T16:35:04.698212Z"}, {"uuid": "bf13fb93-db7f-4615-84fe-1463b0754d12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63000", "type": "seen", "source": "https://gist.github.com/alon710/c6373b33ac6c019650400085845933ec", "content": "# CVE-2026-63000: CVE-2026-63000: Cross-Site Request Forgery in REDAXO CMS Package Update API\n\n> **CVSS Score:** 6.4\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63000\n\n## Summary\nA Cross-Site Request Forgery (CSRF) vulnerability in REDAXO CMS prior to version 5.21.2 allows unauthenticated remote attackers to trigger unauthorized package updates by exploiting an insecure default configuration in the base API class.\n\n## TL;DR\nUnprotected API handler allows attackers to force authenticated administrators to perform unauthorized package updates via CSRF.\n\n## Technical Details\n\n- **CWE ID**: CWE-352\n- **Attack Vector**: Network\n- **CVSS**: 6.4 (Medium)\n- **EPSS Status**: None (recent 2026 listing)\n- **Impact**: Integrity Modification, Unauthorized Package Deployment\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- REDAXO CMS\n- **core**: < 5.21.2 (Fixed in: `5.21.2`)\n\n## Mitigation\n\n- Upgrade REDAXO CMS to version 5.21.2 or higher to resolve the insecure inheritance flaw.\n- Apply manual patch to the `api_package_update.php` file if immediate system upgrades are not possible.\n- Incorporate strict network routing or administrative session management controls to minimize exposure window.\n\n**Remediation Steps:**\n1. Navigate to the root directory of the REDAXO CMS installation.\n2. Download the updated package or pull the latest changes from the release tag 5.21.2.\n3. If patching manually, open the file `redaxo/src/addons/install/lib/api/api_package_update.php`.\n4. Add the `requiresCsrfProtection` method with a return value of `true` directly into the class scope.\n5. Test endpoint functionality by attempting to call the update handler without a valid CSRF token parameter to confirm that the API router rejects the request.\n\n## References\n\n- [GitHub Security Advisory GHSA-m8r3-22v6-g877](https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877)\n- [Fix Commit in REDAXO Repository](https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3)\n- [GitHub Pull Request 6579](https://github.com/redaxo/core/pull/6579)\n- [REDAXO 5.21.2 Release Details](https://github.com/redaxo/core/releases/tag/5.21.2)\n- [CVE-2026-63000 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-63000)\n- [NVD Vulnerability Details page](https://nvd.nist.gov/vuln/detail/CVE-2026-63000)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63000) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T18:31:57.687627Z"}]}