CVE-2026-46511

The record

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.

Affected packages

Related vulnerabilities

• GHSA-x3x5-7h4h-gwxg HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack Same vulnerability
• CVE-2026-46357 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
• CVE-2026-46496 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
• CVE-2026-46395 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
• CVE-2026-46393 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
• CVE-2026-46396 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs
• GHSA-g2g8-95qg-v35h HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint Also affects @haxtheweb/haxcms-nodejs
• CVE-2026-48527 HAX CMS helps manage microsite universe with PHP or NodeJs backends. Also affects @haxtheweb/haxcms-nodejs