{"schema":"threatline.record/2","record":{"id":"GHSA-fw98-549m-whxx","aliases":["GHSA-fw98-549m-whxx"],"summary":"Package API does not check for admin permission","details":"## Root cause\n\nThe core API function `rex_api_package` (`rex-api-call=package`), which installs, uninstalls, activates, deactivates and deletes packages, did not check whether the current user is an administrator. It only required a valid CSRF token for this API function.\n\nPackage management is restricted to administrators in the backend: the packages page and all API functions of the `install` addon check for admin permission. `rex_api_package` was the only exception.\n\n## Impact\n\nA backend user without admin permission who holds a valid CSRF token for `rex_api_package` can manage all locally available packages, for example:\n\n- uninstall packages, including system addons like `structure`, whose uninstall routines drop their database tables (e.g. all articles and their content),\n- deactivate packages, which can break the backend or the website,\n- install or activate packages that are present in the file system but deliberately not installed,\n- delete non-system packages from the file system.\n\nPreconditions: the CSRF token is stored in the user's session and is only generated on pages that are restricted to administrators. In practice this means that the user had admin permission in the same session and was demoted afterwards (the session stays valid), or that the token was obtained via another vulnerability. A user who never had admin permission in the session can't obtain a valid token through the regular backend.\n\nPackage management is not available in live mode, so installations in live mode are not affected.\n\n## Fix\n\nFixed in 5.21.5: `rex_api_package` now requires admin permission, like the API functions of the `install` addon.\n","categories":["Unclassified"],"product":"redaxo/source","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx","source_modified_at":"2026-10-06T15:11:30Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"composer","name":"redaxo/source"},"range":"<= 5.21.4"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx","source_modified_at":"2026-10-06T15:11:30Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"composer","name":"redaxo/source"},"version":"5.21.5"}],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T15:11:30Z","modified_at":"2026-10-06T15:11:30Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/redaxo/core/security/advisories/GHSA-fw98-549m-whxx","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-06T15:11:30Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T15:11:30Z","content_hash":"c22ab714f7d61e305a5276438536111d482381affe8a7a31fa240a3584a55e74"}}