CVE-2026-35185
Information Disclosure via Public /server-status Endpoint in HAX CMS
Publication date: 2026-04-06
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| psu | haxiam | 11.0.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-532 | The product writes sensitive information to a log file. |
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes sensitive information such as authentication tokens, user activity, client IP addresses, and server configuration details to unauthorized users. Such exposure compromises user privacy and could lead to unauthorized access and data breaches.
Because of the unauthorized disclosure of sensitive personal and system information, this vulnerability could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and secure access controls.
Specifically, GDPR mandates the protection of personal data and requires organizations to implement appropriate technical measures to prevent unauthorized access. Similarly, HIPAA requires safeguarding protected health information. The exposure of authentication tokens and client IP addresses could be considered a failure to adequately protect such data.
Can you explain this vulnerability to me?
This vulnerability affects HAX CMS versions prior to 25.0.0, where the /server-status endpoint is publicly accessible without any authentication.
Because of this, sensitive information is exposed to any unauthenticated user. This includes authentication tokens (user_token), real-time user activity such as API calls, client IP addresses, and detailed server configuration data like Apache server version, server uptime, load, and OpenSSL version.
The exposure allows attackers to monitor live user interactions and gather internal infrastructure details, which can be used for reconnaissance and planning further attacks.
How can this vulnerability impact me? :
This vulnerability can have several impacts:
- Compromise of user privacy due to exposure of authentication tokens and user activity.
- Unauthorized monitoring of real-time user interactions and client IP addresses.
- Disclosure of internal server and infrastructure details that can aid attackers in planning further attacks.
- Potential abuse of exposed authentication credentials and internal API endpoints.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the /server-status endpoint of the HAX CMS server is publicly accessible without authentication.
You can use commands like curl or wget to request the /server-status URL and inspect the response for sensitive information such as authentication tokens (user_token), client IP addresses, user activity, and server configuration details.
- curl http://<target-server>/server-status
- wget -qO- http://<target-server>/server-status
If the response contains detailed server status information, authentication tokens, or user activity data without requiring authentication, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade HAX CMS to version 25.0.0 or later, where this vulnerability is fixed.
Until the upgrade can be performed, restrict access to the /server-status endpoint by implementing proper access controls such as IP whitelisting, authentication requirements, or disabling the endpoint if not needed.
Additionally, monitor your server logs for any unauthorized access attempts to /server-status and consider rotating any potentially exposed authentication tokens.