Is CVE-2026-117536 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117536 being exploited in the wild.

How severe is CVE-2026-117536?

High severity, with a CVSS score of 8.8, published 27 October 2026.

How is CVE-2026-117536 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-117536?

Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117536: REDAXO CSRF token bypass in user administration

CVE-2026-117536 · Severity: high · CVSS 8.8 · Published 2026-10-27

REDAXO is a web content management system used for building and managing websites. The backend user administration interface has a cross-site request forgery vulnerability that allows an attacker to trick a logged-in administrator into clicking a link to grant themselves admin rights, deactivate user accounts, or lock administrators out of the system. An attacker needs only to lure an authorized backend user to a malicious page while they are logged in.

Technologies: REDAXO. Vendors: REDAXO.

Quick answers

Is CVE-2026-117536 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117536 being exploited in the wild.
How severe is CVE-2026-117536?: High severity, with a CVSS score of 8.8, published 27 October 2026.
Which products and versions are affected?: REDAXO before 5.21.3.
Is there a fix for CVE-2026-117536?: Yes: fixed in 5.21.3. Until then: The token check has been modified to unconditionally require a valid CSRF token when FUNC_UPDATE or FUNC_APPLY parameters are present, regardless of the save parameter state. Upgrade to version 5.21.3 or later.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-07-31"}, {"kind": "patched", "at": "2026-07-31", "note": "version 5.21.3"}, {"kind": "advisory", "at": "2026-10-27"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-117536 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-117536?: Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.21.3

The token check has been modified to unconditionally require a valid CSRF token when FUNC_UPDATE or FUNC_APPLY parameters are present, regardless of the save parameter state. Upgrade to version 5.21.3 or later.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-07-31"}, {"kind": "patched", "at": "2026-07-31", "note": "version 5.21.3"}, {"kind": "advisory", "at": "2026-10-27"}]

Technical details

The CSRF token check in the user administration page (users/users) is guarded by a condition on the save parameter that the actual update path does not share. Requests carrying FUNC_UPDATE or FUNC_APPLY without the save parameter bypass the token validation entirely and reach the unprotected update code path. Since parameters are read via rex_request() (covering both GET and POST) with REDAXO's default SameSite=Lax session cookie, a plain GET request with embedded parameters is sufficient for exploitation.

Affected products

REDAXO REDAXO before 5.21.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.