CVE-2026-46511 Details
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.
A stored cross-site scripting vulnerability has been identified in HAX CMS versions through 25.0.0. This issue exists in the '/system/api/connectionSettings' endpoint, where an authenticated attacker can exploit dynamic token exposure to perform a cross-tenant account takeover. The API inadvertently leaks authentication tokens, including 'jwt', 'user_token', 'site_token', and 'appstore_token', into a global JavaScript variable, 'window.appSettings'. An attacker can use the XSS vulnerability to manipulate a victim's browser into fetching their connection settings, extracting the tokens, and sending them to an attacker-controlled webhook.
Users can update to HAX CMS version 26.0.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/haxtheweb/issues/security/advisories/GHSA-x3x5-7h4h-gwxg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/haxtheweb/issues/security/advisories/GHSA-x3x5-7h4h-gwxg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-922 | Insecure Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HAX CMS | <= 25.0.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |