Which versions of PHP are affected by CVE-2026-35185?

HAX CMS versions prior to 25.0.0 contain an unauthenticated information disclosure vulnerability exposing authentication tokens, session data, and infrastructure details through an accessible…. A patch is available.

How to fix or mitigate CVE-2026-35185?

Within 24 hours: Identify all HAX CMS instances and document current versions via asset inventory. Within 7 days: Upgrade all HAX CMS deployments to version 25.0.0 or later and verify /server-status endpoint is no longer publicly accessible. Within 30 days: Conduct session token audit, rotate any tokens exposed during vulnerability window, and implement network-based access controls restricting /server-status to administrative networks only as defense-in-depth.

PHP CVE-2026-35185

Q: What is the CVSS score of CVE-2026-35185?

CVE-2026-35185 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19469 HIGH

Improper Access Control (CWE-284)

2026-04-06 GitHub_M

PHP Authentication Bypass

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:05 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

25.0.0

Analysis Updated

Apr 16, 2026 - 04:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 16, 2026 - 04:33 vuln.today

cvss_changed

EUVD ID Assigned

Apr 06, 2026 - 19:45 euvd

EUVD-2026-19469

Analysis Generated

Apr 06, 2026 - 19:45 vuln.today

CVE Published

Apr 06, 2026 - 19:24 nvd

HIGH 8.7

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0.

AnalysisAI

Information disclosure in HAX CMS/HAXiam prior to 25.0.0 exposes authentication tokens, user activity logs, client IP addresses, and server configuration through a publicly accessible /server-status endpoint requiring no authentication. Remote unauthenticated attackers can harvest active session tokens and infrastructure details to facilitate credential theft and reconnaissance. EPSS score of 0.06% (19th percentile) suggests limited observed exploitation attempts, with no CISA KEV listing or public exploit identified at time of analysis.

Technical ContextAI

HAX CMS is a microsite management platform supporting both PHP and NodeJs backend implementations (CPE: cpe:2.3:a:haxtheweb:haxiam). The vulnerability stems from improper access control (CWE-284: Improper Access Control) on an administrative monitoring endpoint. The /server-status path, typically used for debugging or operational monitoring, was left without authentication enforcement in versions prior to 25.0.0. This endpoint exposes real-time operational data including user_token values (session/authentication credentials), active user interactions, source IP addresses, and potentially server configuration parameters. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-accessible exploitation with low complexity and no prerequisites. The VI:H (High Vulnerable System Integrity Impact) rating reflects that exposed tokens enable attackers to impersonate legitimate users, while VC:N indicates the confidentiality breach is contained within the vulnerable system's data exposure rather than lateral information access.

RemediationAI

Upgrade to HAXiam version 25.0.0 or later, which resolves the access control deficiency on the /server-status endpoint per the vendor security advisory at https://github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7. For environments unable to immediately upgrade, implement network-level restrictions blocking external access to the /server-status path via web application firewall rules or reverse proxy configuration (e.g., NGINX location block denying external IPs, or Apache .htaccess IP allowlist). This mitigation prevents unauthenticated internet access while maintaining internal monitoring capability, though it requires maintaining IP allowlists and may break legitimate remote administration. Alternatively, disable the server-status endpoint entirely if operational monitoring is not required, though this eliminates debugging visibility. Post-remediation, rotate all user authentication tokens as exposed credentials may have been harvested prior to patching, particularly for installations with extended internet exposure. Review web server access logs for suspicious requests to /server-status from external IP ranges to identify potential prior reconnaissance.