Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2016-20053: Redaxo CMS 5.2 Allows Unauthenticated Account Creation by Tricking Admins
CVE-2016-20053 · published 7 months ago
Summary
A security issue in Redaxo CMS 5.2 lets attackers create admin accounts by tricking logged-in administrators into visiting malicious websites. This can happen without needing a password. To fix this, update to the latest version of Redaxo CMS or take other security measures to protect your site.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| redaxo | redaxo |
5.2 cpe:2.3:a:redaxo:redaxo:5.2:*:*:*:*:*:*:* |
Original advisory text
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visitin...
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published4 Apr 2026
Updated1 Nov 2026
First seen4 Apr 2026
Track software like this
Free during beta