CVE-2016-20053: CSRF in Redaxo CMS 5.2

The primary impact of CVE-2016-20053 is the unauthorized creation of administrative user accounts. An attacker can craft HTML forms targeting the users endpoint, embedding hidden fields containing the necessary credentials and account parameters. By tricking an authenticated administrator into visiting a page containing this malicious form, the attacker can effectively add a new administrator account without the administrator's knowledge or consent. This grants the attacker full administrative privileges, enabling them to modify content, install malicious code, and potentially compromise the entire Redaxo CMS installation. The blast radius extends to all data and functionality accessible through the CMS, including sensitive user information and critical website configurations.

1. Reserved2026-04-04
2. Published2026-04-04
3. Modified2026-04-06
4. EPSS updated2026-04-12

The primary mitigation for CVE-2016-20053 is to upgrade Redaxo CMS to a version that includes the security patch. Unfortunately, the specific fixed version is not provided. If upgrading immediately is not feasible, consider implementing temporary workarounds such as implementing strict input validation on the users endpoint to prevent malicious data from being submitted. Additionally, consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review user accounts and permissions to identify any unauthorized accounts that may have been created.