CVE-2026-46390CWE-639

HAX CMS has Unauthenticated Git Access via User-Controlled Key

Medium · published June 5, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-05T18:16Z
EPSS history
Timeline
  • 05 JUN 18:16Z
    HAX CMS has Unauthenticated Git Access via User-Controlled Key
    cvelistv5