CVE-2026-46390
Unauthenticated Git Repository Access in HAX CMS
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| haxtheweb | haxcms-php | From 2.0.0 (inc) to 26.0.0 (exc) |
| haxtheweb | haxcms-php | 26.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated users to access and browse git repositories and their history without authorization, exposing sensitive information including source code and potentially confidential data like secrets.
Such unauthorized exposure of sensitive or confidential data could lead to non-compliance with common standards and regulations like GDPR or HIPAA, which require protection of sensitive information and prevention of unauthorized access.
Can you explain this vulnerability to me?
CVE-2026-46390 is a vulnerability in the HAX CMS system affecting versions greater than 2.0.0 and prior to 26.0.0. It involves the gitlist plugin, which is exposed to unauthenticated users, allowing them to browse git repositories and their history without proper authorization.
An attacker can exploit this vulnerability by modifying a URL to include a known User ID, thereby gaining unauthorized access to repositories and commits belonging to that user. This leads to exposure of sensitive information such as source code and potentially confidential data like secrets.
The vulnerability is caused by an authorization bypass through a user-controlled key and requires no special privileges, user interaction, or complex attack conditions, making it relatively easy to exploit over a network.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to access and browse your git repositories and their history without authentication.
Such unauthorized access can lead to exposure of sensitive information including source code and confidential data such as secrets, which could be used for further attacks or intellectual property theft.
Because the exploit requires no special privileges or user interaction, it poses a moderate risk and can be easily carried out over a network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the gitlist plugin endpoints without authentication and checking if git repositories and their history are accessible.
One way to detect this is by sending HTTP requests to URLs related to the gitlist plugin and observing if repository data is returned without requiring login.
- Use curl or similar tools to request repository URLs, for example: curl -i http://<target>/gitlist/<user_id>/
- Check for unauthorized access by modifying the URL to include known User IDs and see if repository or commit information is exposed.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the HAX CMS to version 26.0.0 or later, where the gitlist plugin vulnerability has been patched.
Until the upgrade can be performed, restrict access to the gitlist plugin endpoints by implementing authentication or network-level access controls to prevent unauthenticated browsing.