REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Medium · CVSS 6.4

### Summary The `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

Remediation

Upgrade redaxo/source to 5.21.2 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-m8r3-22v6-g877

← All threats