REDAXO CMS CVE-2026-117536

Exploitation requires a victim who is already logged into the REDAXO backend and holds the users[] permission, and who actively opens an attacker-controlled page while that session is valid; no authentication, account, or special privilege is needed by the attacker themselves (classic CSRF). The flaw is reachable as a plain GET because parameters are read via rex_request() against $_REQUEST and the session cookie defaults to SameSite=Lax (sent on top-level GET navigation). The privilege-escalation variant (useradmin=1) specifically requires the victim to be an administrator, since the permission guard evaluates in the victim's favour; the account-deactivation and sole-administrator-lockout variants work for any users[]-permission victim as long as the target is not an administrator. Limiting factors: active user interaction is mandatory, the victim must possess the users[] permission, and passwords cannot be changed via this path because userpsw is read through rex_post() and is unreachable via GET. The only complete fix is updating to 5.21.3.

The CVSS 4.0 base score is 8.6 (High), driven by a network vector (AV:N), low complexity (AC:L), no attacker privileges (PR:N), and high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H). The one metric that meaningfully constrains real-world risk is UI:A - the attack is a CSRF that requires a logged-in backend user holding the users[] permission to actively open an attacker-controlled link, so it cannot be driven autonomously against a server. No EPSS score and no KEV listing were provided in the input, so there is no quantitative exploitation-probability signal and no evidence of active exploitation; absence of these is not evidence of safety but should not be read as active-exploitation either. The vendor advisory includes a concrete crafted GET URL and raw HTTP request demonstrating the bypass, which functions as a public PoC reference (not independently verified as weaponized exploit code). The vuln.today decision label is 'this_week', which aligns with the profile: a serious, patchable flaw warranting prompt remediation within the week rather than emergency same-day action. Net assessment: this is a genuine privilege-escalation/account-takeover issue that is real and should be patched promptly, but its dependence on a privileged, interacting victim makes it targeted/social-engineering-dependent rather than a mass-exploitable worm candidate.

An attacker with a low-privileged REDAXO backend account (or no account at all) crafts a link such as index.php?page=users/users&user_id=3&FUNC_UPDATE=1&useradmin=1&userstatus=1 and lures a logged-in administrator (or any user with the users[] permission) to open it. Because the session cookie defaults to SameSite=Lax and is sent on top-level GET navigation, and the CSRF token check is skipped when the save parameter is absent, the victim's authenticated session grants the attacker's chosen account administrator rights, deactivates a target account, or locks out the sole administrator. A public PoC reference (the crafted URL and HTTP request) is published in the vendor advisory; it is not verified as working exploit code, though the trigger is fully described.