CVE-2026-62998

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62998
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62998.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62998
Aliases
Published
2026-09-23T14:07:04Z
Modified
2026-09-25T03:48:35Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Details

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-20",
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62998.json"
}
References

Affected packages

Git / github.com/redaxo/core

Affected ranges

Type
GIT
Repo
https://github.com/redaxo/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c44ba5206a28427984100c994010f2aaa6703efd
Fixed
31d61c6a460b6c8daf09baa75d6477fa3a93a68b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.21.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0
5.0.0-alpha7
5.0.0-beta1
5.0.0-beta2
5.0.0-rc
5.0.1
5.1.0
5.10.0
5.10.0-beta1
5.10.0-beta2
5.11.0
5.11.0-beta1
5.12.0
5.12.0-beta1
5.12.0-beta2
5.12.0-beta3
5.13.0
5.13.0-beta1
5.13.0-beta2
5.13.1
5.13.2
5.14.0
5.14.0-beta1
5.14.0-beta2
5.14.1
5.15.0
5.15.0-beta1
5.16.0
5.16.0-beta1
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.0-beta1
5.20.0
5.20.1
5.20.2
5.21.0
5.21.0-beta1
5.21.1
5.3.0
5.4.0
5.4.0-beta1
5.4.0-beta2
5.5.0
5.5.0-beta1
5.5.1
5.6.0
5.6.0-beta1
5.6.1
5.7.0
5.7.0-beta1
5.7.0-beta2
5.7.0-beta3
5.8.0
5.8.0-beta1
5.9.0
5.9.0-beta1
5.9.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62998.json"