CVE-2026-46511
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
HAX CMS prior to version 26.0.0 had a Stored XSS vulnerability that, combined with dynamic token exposure in the `/system/api/connectionSettings` endpoint, allowed an authenticated attacker to perform a complete account takeover of other users. The attacker could exploit this vulnerability to steal session tokens from the victim's browser.
Risk Assessment
Organizations using HAX CMS are at risk of complete user account takeover, which can lead to data loss and privacy breaches. An attacker could gain access to sensitive information and resources.
Recommendation
It is recommended to update HAX CMS to version 26.0.0 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application and monitoring user activity is advisable.
Other vulnerabilities in HAX CMS
See all- CVE-2026-46399Critical
HAX CMS versions prior to 26.0.0 have an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands, leading to code execution on the HAX CMS server.
- CVE-2026-46396Critical
HAX CMS, which manages microsites with PHP or NodeJs backends, has a stored XSS vulnerability in versions prior to 26.0.0. The issue arises from improper sanitization of `<iframe>` elements, allowing execution of malicious JavaScript.
- CVE-2026-46493High
HAX CMS prior to version 26.0.1 uses `uniqid` for generating salts, which is unsuitable and can lead to predictable salts. Version 26.0.1 fixes this issue.
- CVE-2026-46401Medium
HAX CMS versions prior to 26.0.0 have an improper session termination vulnerability where authentication tokens remain valid after user logout. Attackers with valid tokens can maintain persistent access to CMS functionality, bypassing session termination.
- CVE-2026-46400High
HAX CMS PHP versions 11.0.6 through 24.x.x have a file upload vulnerability that only validates file extensions via regex, without checking actual content or MIME type. Attackers can upload malicious files (e.g., PHP webshells) disguised as images, potentially leading to remote code execution.
- CVE-2026-46398High
In HAX CMS versions 25.0.0 to 25.0.0 (prior to 26.0.0), the haxcms_refresh_token cookie is set without the Secure flag. This allows transmission over unencrypted HTTP, making it vulnerable to theft via packet sniffing.
- CVE-2026-46397Medium
HAX CMS before version 26.0.0 contains an Authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint. A low-privileged user can read arbitrary files on the server by manipulating the location field in site.json. This allows exfiltration of sensitive system files.
- CVE-2026-46357Medium
HAX CMS, used to manage microsites with PHP or Node.js backends, crashes before version 26.0.0 when an authenticated attacker sends a crafted site creation request to the createSite endpoint. A single request can take the entire application offline, requiring a manual server restart.
- CVE-2026-46393High
HAX CMS, which manages microsites with PHP or NodeJs backends, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0. This allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory.
- CVE-2026-48527High
HAX CMS versions up to 26.0.0 contain a stored XSS vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with page editing permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.
Original NVD description (English source)
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.