A cross‑site request forgery flaw in REDAXO’s backend allows an attacker to manipulate the safemode GET parameter in index.php without any CSRF token validation. The vulnerability can be used to write safe_mode: false to the configuration file or to enable session safe mode, thereby disabling global safe mode or turning off backend addons. This is a classic CSRF weakness (CWE‑352) that can alter system configuration and affect the availability of critical features.

The flaw affects the REDAXO core component in all releases before 5.21.5. Administrators who run any of those versions are at risk until they apply an update.

The CVSS score of 5.1 indicates a moderate severity impact. While no EPSS score is available, the vulnerability is not listed in CISA’s KEV catalog, and its exploitation requires a logged‑in administrator to be tricked into visiting a crafted URL. The attack is browser‑based and can be launched remotely by sending a link to an admin user, but it is not a remote code execution or denial of service vulnerability. The damage is limited to configuration changes that may reduce security and disrupt functionality.