[MEDIUM] REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

PKSA-759m-q6p6-jn53 CVE-2026-63000 GHSA-m8r3-22v6-g877

Affected package: redaxo/source

Affected version: <=5.21.1

Reported by:
GitHub