REDAXO CMS CVE-2026-116895

Exploitation requires that the victim is currently authenticated as a REDAXO backend administrator and actively opens the attacker's crafted link/page (UI:A), and that the installation is NOT in live mode - the advisory states safe mode cannot be toggled at all in live mode. The flaw is reachable because the safemode parameter is accepted as a plain GET without CSRF-token validation, and the default SameSite=Lax session cookie permits cross-site top-level GET navigations to carry the session. Limiting factors: the hard requirement for an active, logged-in admin victim plus social-engineering interaction, the live-mode exclusion, and the bounded effect (toggling safe mode / disabling backend addons or rewriting safe_mode:false in config.yml) with no confidentiality loss and no privilege gain. Fixed versions (5.21.5) only process safemode with a valid CSRF token.

This is a genuinely medium-severity, lower-priority issue rather than an urgent one. The CVSS 4.0 base score is 5.1 (Medium), with AV:N/AC:L/AT:N/PR:N but critically UI:A - the attack is network-reachable and low-complexity, yet it cannot fire without an authenticated administrator actively opening an attacker-controlled link. Impact is bounded: VC:N (no confidentiality loss) with only VI:L and VA:L reflecting the limited integrity/availability effect of toggling safe mode or disabling backend addons; the advisory explicitly states the attacker gains no privileges and no code execution. No EPSS score and no KEV listing are present in the input, so there is no signal of active exploitation; this is not CISA KEV. The references are two vendor/coordinator advisories (GitHub GHSA and VulnCheck), not working exploit code, so there is no confirmed public PoC exploit. The vuln.today decision label is 'this_month', consistent with a patch-promptly-but-not-emergency posture. Net: a real but modest CSRF with a hard precondition (admin must be logged in and tricked, and the install must not be in live mode), appropriately rated medium - prioritize patching in a normal cycle, not as an incident.

An attacker crafts a web page or email link pointing to the REDAXO backend index.php with the safemode GET parameter and entices a currently-logged-in administrator to open it; because the action is a plain GET processed without a CSRF token and the session cookie is SameSite=Lax, the top-level navigation silently toggles safe mode. Setting safemode=0 can revert a deliberately-enabled global safe mode (writing safe_mode: false to config.yml), while safemode=1 disables all non-setup backend addons for that session. No confirmed working public exploit code is identified; only vendor/coordinator advisories exist.