This vulnerability allows attackers to bypass the CSRF token check on the REDAXO backend user administration page when the save parameter is omitted, enabling a crafted GET request to trigger privilege escalation. An attacker can luring a logged‑in backend user with users[] permission to a malicious link to grant themselves administrator rights, deactivate other accounts, or lock out the sole administrator. As a result, the confidentiality, integrity, and availability of the system are compromised through unauthorized account control.

The flaw affects REDAXO Core versions prior to 5.21.3. Existing installations that have not been updated to 5.21.3 or later are vulnerable. No specific sub‑components or third‑party plugins are noted as affected, so the core backend user administration functionality is the primary target.

The CVSS score of 8.6 indicates high severity, and although the EPSS score is not publicly available, the exploitation path requires only a crafted link and a logged‑in user, which is a realistic scenario in many deployments. The vulnerability is not listed in the CISA KEV catalog, but the described attack vector relies on CSRF and does not require network exposure beyond the victim's browser. Consequently, the risk remains significant, especially in environments where backend users have broad permissions.