Is there a patch available for CVE-2026-46390?

Yes, a patch is available for CVE-2026-46390. Update the affected software to the latest version immediately.

HAX CMS CVE-2026-46390

Q: What is the CVSS score of CVE-2026-46390?

CVE-2026-46390 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34881 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-05 GitHub_M

PHP Authentication Bypass

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Analysis Generated

Jun 05, 2026 - 19:29 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

6.9 (MEDIUM)

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.

AnalysisAI

Unauthenticated repository exposure in HAX CMS PHP (versions 2.0.0 through 25.x) allows any remote attacker to browse git repositories and full commit history via the unprotected gitlist plugin. The CVSS 4.0 vector confirms no authentication, no user interaction, and network-level access with low complexity, making exploitation trivially achievable against any public-facing instance. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the absence of access controls on the gitlist endpoint represents a direct confidentiality risk for any sensitive data stored in or committed to those repositories.

Technical ContextAI

HAX CMS is a microsite management platform supporting PHP and Node.js backends; the affected component is its gitlist plugin, a web-based interface for browsing git repository contents and history. The CPE cpe:2.3:a:haxtheweb:haxcms-php identifies the PHP backend variant as the confirmed affected product. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the gitlist plugin endpoints lack access control enforcement, permitting any caller - authenticated or not - to traverse repository trees and inspect commit logs by directly referencing resource keys the server does not validate against session identity. This is a missing authorization check, not a bypass of an existing check, meaning the attack surface is the plugin's default route exposure rather than a circumvention of authentication logic.

RemediationAI

Vendor-released patch: version 26.0.0 of HAX CMS PHP, which applies authorization controls to the gitlist plugin. Upgrade to 26.0.0 as the primary fix, referencing the advisory at https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c for upgrade guidance. If immediate upgrade is not possible, restrict external access to the gitlist plugin route at the web server or reverse proxy layer - for example, deny requests to the gitlist endpoint path in nginx or Apache configuration to prevent unauthenticated browsing, accepting that this disables the git browsing feature for all users until the patch is applied. Alternatively, place the entire HAX CMS instance behind a network-level authentication gateway (e.g., HTTP basic auth at the reverse proxy) as a compensating control, noting this adds friction for legitimate users and does not fix the underlying authorization flaw.