REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Affected: Packagist: redaxo/source

### Summary The `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

### Details **File:** `redaxo/src/core/lib/api_function.php:277-280` ```php protected function requiresCsrfProtection() { return false; // DEFAULT — subclasses must opt in } ```

**File:** `redaxo/src/addons/install/lib/api/api_package_update.php:8-39` ```php class rex_api_install_package_update extends rex_api_function { public function execute() { if (!rex::getUser()?->isAdmin()) { throw new rex_api_exception('You do not have the permission!'); } $addonkey = rex_request('addonkey', 'string'); $fileId = rex_request('file', 'int'); $installer = new rex_install_package_update(); // ... downloads and installs $addonkey version $fileId from redaxo.org } // requiresCsrfProtection() NOT overridden — defaults to false } ```

For comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true`. Only `rex_api_install_package_update` is missing this.

### PoC ```html <!-- Attacker-controlled page --> <img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=install_package_update&addonkey=some_addon&file=4…