REDAXO EUVD-2026-110799

Exploitation requires an authenticated REDAXO backend user to be lured into visiting an attacker-controlled page while their backend session is active; the attacker needs no credentials. The destructive clearall path (permanent deletion of all article snapshots) specifically requires the victim to be an administrator, because the history administration page sits under the system page. The snap rollback path requires only a victim holding the history[article_rollback] permission. Both actions were reachable as plain GET requests via rex_request() against $_REQUEST with no CSRF token, and REDAXO's default SameSite=Lax session cookie is still sent on a top-level GET navigation, so no form submission or JavaScript on the target was needed. Limiting factors: required user interaction (victim must open the malicious page while logged in), the victim's privilege level gating which action succeeds, and the fix in 5.21.3 which enforces token validation. Only versions <=5.21.2 are affected.

This is a genuine but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity CSRF requiring active victim interaction, with impact limited to integrity and availability of content/history data (VC:N/VI:L/VA:L) and no scope change - consistent with the 5.1 Medium score and the vendor's 'this_month' priority rather than act_now/emergency. No KEV listing and no EPSS score were provided, and no public exploit or PoC reference is present in the sources, so there is no signal of active or widespread exploitation; the detailed GHSA root-cause writeup is advisory material, not working exploit code. The key limiter is that the attacker gains no privileges of their own - exploitation depends entirely on a logged-in backend user (an administrator for the destructive clearall path, or a holder of the history[article_rollback] permission for the snap path) being lured to an attacker-controlled page. Note the PR:N applies to the attacker, who is unauthenticated, even though the attack rides a privileged victim's authenticated session; this is normal for CSRF and not a contradiction. Overall: a real, confirmed, patched weakness worth remediating in the normal cycle, not an emergency.

An attacker crafts a web page that, when opened by a logged-in REDAXO backend administrator, navigates the browser to the backend history URL with func=clearall; REDAXO's SameSite=Lax session cookie is sent on the top-level GET, so the action runs in the victim's session and irreversibly deletes all stored article snapshots. A lower-privilege variant uses rex_history_function=snap to silently revert an article to an earlier stored state against a victim holding the article_rollback permission. No public exploit code is identified, though the GHSA advisory documents the exact triggering URLs.