Medium severity · published Jun 5, 2026
CVE-2026-46390
HAX CMS has Unauthenticated Git Access via User-Controlled Key
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
haxcms-php · haxtheweb
>= 2.0.0, < 26.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46390
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46390
github.com
https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
More from haxcms-php
9.4
CVE-2026-46399
Authenticated Remote Code Execution via File Overwrite
8.8
CVE-2026-46398
HAX CMS Missing Secure Flag on Cookie
8.7
CVE-2026-46400
HAXCMS PHP has a File Upload Validation Bypass
8.7
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
8.7
CVE-2026-46392
HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation