Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2026-116895: Redaxo/core allows admin settings to be changed via crafted link
CVE-2026-116895 · published 8 days ago
Summary
If an administrator clicks a malicious link, the system can turn off safety features or disable extensions without proper permission checks. This can leave the site exposed to further attacks or reduce its functionality. Apply the latest update for Redaxo core to fix the issue and ensure administrators only make changes through trusted interfaces.
What to do
- Update redaxo core to version 5.21.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| redaxo | core | < 5.21.5 |
Original advisory text
REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1168... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-116895 Vendor Advisory
- https://github.com/redaxo/core/security/advisories/GHSA-423v-8x3h-gxr3 vendor-advisory
- https://www.vulncheck.com/advisories/redaxo-before-5.21.5-csrf-via-safe-mode-tog... third-party-advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published27 Oct 2026
Updated4 Nov 2026
First seen27 Oct 2026
Sources
CVE-2026-116895 · NVD
CVE-2026-116895 · MITRE
CVE-2026-116895 · OSV
GHSA-423v-8x3h-gxr3 · GHSA
Track software like this
Free during beta