The vulnerability exists in the Article History plugin of REDAXO versions earlier than 5.21.3. It is a cross‑site request forgery flaw that allows a malicious page to trigger unvalidated GET requests containing func=clearall or rex_history_function=snap. An attacker can entice a logged‑in administrator or other backend user to visit the page, causing the plugin to permanently delete all article snapshots or revert articles to prior states. All of this occurs without requiring credentials other than the victim’s session cookie, leading to loss of editorial history and potential loss of content integrity.

The affected product is REDAXO core version 5.21.3 and earlier. Any deployment of REDAXO that has the Article History plugin enabled and has not applied the 5.21.3 update is vulnerable. The vendor, REDAXO, is responsible for the fix.

The CVSS score for this flaw is 5.1, indicating moderate severity. The exploit probability (EPSS) is not available and it is not listed in the CISA KEV catalog. The attack is performed via a simple web request; the attacker must influence a logged‑in backend user to visit a crafted URL. If successful, the attacker can delete all history snapshots or roll back content to an earlier state, affecting data integrity and causing loss of editorial records. Because the flaw can only be leveraged by compromising a user’s session, the likelihood of widespread exploitation is limited, but any organization that hosts REDAXO in a publicly reachable backend should consider the risk substantial due to the ease of phishing or social‑engineering techniques.