CVE-2026-46511: HAX CMS account takeover via Stored XSS and token exposure

CVE-2026-46511 · Severity: high · CVSS 4 · Published 2026-06-05

HAX CMS is a platform used to create and manage collections of small websites (microsites). A security flaw allows a logged-in user to steal the digital 'keys' of other users, including administrators, by tricking their web browser into revealing secret session tokens. If successful, an attacker can take over other accounts, modify or delete websites, and access sensitive data without needing a password.

Technologies: @haxtheweb/haxcms-nodejs (npm). Vendors: HAX the Web, npm.

Quick answers

Is CVE-2026-46511 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46511 being exploited in the wild.
How severe is CVE-2026-46511?
High severity, with a CVSS score of 4, published 5 June 2026.
Which products and versions are affected?
HAX the Web HAXcms Node.js <= 25.0.0; @haxtheweb/haxcms-nodejs (npm) <= 25.0.0, SEMVER:introduced=0,fixed=26.0.0.
Is there a fix for CVE-2026-46511?
Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46511 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46511?
Check whether you run HAX the Web HAXcms Node.js or @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later
    npm install @haxtheweb/haxcms-nodejs@26.0.0

Technical details

HAX CMS (PHP and Node.js versions) prior to 26.0.0 contains a vulnerability where the `/system/api/connectionSettings` endpoint leaks active session authentication tokens (JWT, user_token, site_token, and appstore_token) into the global JavaScript variable `window.appSettings`. By leveraging a Stored XSS vulnerability (e.g., via malicious iframes or video-player tags), an authenticated attacker can execute a script in a victim's browser. This script fetches the victim's connection settings—automatically authenticated by the browser's session cookies—extracts the tokens, and exfiltrates them to an external webhook. This allows the attacker to bypass authentication and perform administrative actions as the victim. The issue is resolved in version 26.0.0.

Affected products

  • HAX the Web haxcms-nodejs <= 25.0.0
  • HAX the Web haxcms-php <= 25.0.0

Identifiers

  • CVE-2026-46511
  • GHSA-x3x5-7h4h-gwxg

Timeline

  • 2026-05-12: advisory: GitHub Security Advisory published
  • 2026-06-05: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.