CVE-2026-62998

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2

Description In this PHP-based content management system, the rex list::getSortColumn() function in redaxo/src/core/lib/list.php fails to verify if the requested column was registered via setColumnSortable(). An authenticated backend user can manipulate the prepareQuery() function to include an unauthorized ORDER BY identifier. This allows for error-based enumeration of columns in joined tables and the ability to order results by sensitive fields, such as rex user.password.

Recommendations Update to version 5.21.2.