CVE-2016-20053 Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
Attackers can create admin accounts via CSRF by tricking administrators into visiting malicious pages, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20053?
CVE-2016-20053 is a medium-severity vulnerability in Redaxo CMS, published on 4 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
Weakness: CWE-352
Which versions are affected by CVE-2016-20053?
It affects 1 product.
Products include Redaxo Redaxo.
How do I fix CVE-2016-20053?
No fix has been published for CVE-2016-20053 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-20053 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20053 exists.
Other vulnerabilities in Redaxo CMS
- CVE-2018-18200 SQL injection in n/a
- CVE-2018-17831 SQL injection in n/a
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
- CVE-2006-2843 Code injection in n/a
- CVE-2006-2844 Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[I
Sources
Also known as GHSA-2r3p-9jrg-pvg9.