CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin

Medium 5.1 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117534?

CVE-2026-117534 is a medium-severity vulnerability in redaxo core, published on 27 Oct 2026.

Official description

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

Weakness: CWE-352

Which versions are affected by CVE-2026-117534?

How do I fix CVE-2026-117534?

No fix has been published for CVE-2026-117534 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117534 being exploited?

There is no known exploitation of CVE-2026-117534 in the wild and no public exploit code.

Sources

Also known as GHSA-463p-v63r-mx34, GHSA-vjwx-3c33-xwmc.