In REDAXO, the API that performs package updates lacks CSRF protection. An attacker that is not logged in can trigger an update of any selected add‑on via the installer API. Because the request runs in the context of a logged‑in administrator’s browser, the attacker can substitute malicious code or alter existing add‑on files. This can lead to unintended changes to site logic, content, or even complete site disruption without the administrator’s consent.

The vulnerability affects all releases of the REDAXO core prior to 5.21.2. Users must verify that they are running a affected version; only the 5.21.2 release and newer contain the fix.

The overall CVSS score of 6.4 indicates moderate severity. No EPSS value is supplied, and the vulnerability is not listed in the CISA KEV catalog, suggesting that published exploit code is not yet known or widespread. The likely attack vector is cross‑site request forgery: a malicious site can embed a request that will be executed in the context of a logged‑in administrator’s browser, triggering the update API without requiring authentication. An attacker must be able to influence the administrator’s browser, but no additional privileges or system access are required. The vulnerability is fixed in REDAXO 5.21.2; installations running newer versions are not affected.