CVE-2026-35185: HAX CMS Information Disclosure Vulnerability

CVE-2026-35185 Overview

CVE-2026-35185 is an Information Disclosure vulnerability affecting HAX CMS, a content management system that helps manage microsite universes with PHP or NodeJs backends. Prior to version 25.0.0, the /server-status endpoint is publicly accessible without authentication, exposing sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This vulnerability allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information.

Critical Impact

Unauthenticated attackers can access sensitive authentication tokens and user data through the exposed /server-status endpoint, potentially enabling session hijacking and reconnaissance attacks.

Affected Products

• HAX CMS versions prior to 25.0.0 (PHP backend)
• HAX CMS versions prior to 25.0.0 (NodeJs backend)

Discovery Timeline

• 2026-04-06 - CVE-2026-35185 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35185

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) on the /server-status endpoint within HAX CMS. The endpoint was designed to provide system administrators with real-time monitoring capabilities, but it lacks any authentication or authorization checks before serving sensitive data.

When an attacker accesses the /server-status endpoint, the server responds with detailed operational information that should be restricted. The exposed data includes active user_token values that can be used to impersonate authenticated users, client IP addresses that reveal the organization's user base and network topology, and server configuration parameters that facilitate further attacks.

The network-accessible nature of this vulnerability means any remote attacker can exploit it without requiring prior authentication or user interaction. The impact is primarily focused on integrity violations, as the disclosed authentication tokens enable attackers to forge user sessions and perform unauthorized actions.

Root Cause

The root cause is improper access control implementation on the diagnostic endpoint. The /server-status functionality was implemented without authentication middleware, allowing direct access to monitoring data that should be restricted to administrative users. This represents a missing security constraint where sensitive operational endpoints were not properly protected during the application's development.

Attack Vector

Exploitation of this vulnerability is straightforward and requires no special tools or techniques. An attacker simply needs to send an HTTP request to the /server-status endpoint on a vulnerable HAX CMS instance. The server responds with sensitive data in its default response format.

The attack flow involves the following steps:

1. The attacker identifies a HAX CMS installation through fingerprinting or reconnaissance
2. The attacker sends an HTTP GET request to the /server-status endpoint
3. The server returns sensitive information including authentication tokens, user activity logs, and configuration details
4. The attacker uses the obtained user_token values to hijack active user sessions
5. The attacker leverages infrastructure information for additional reconnaissance

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35185

Indicators of Compromise

• Unusual access patterns to the /server-status endpoint from external IP addresses
• Multiple requests to /server-status from the same source in short time intervals
• Session token reuse from different IP addresses indicating potential token theft
• Reconnaissance activity following access to the /server-status endpoint

Detection Strategies

• Monitor web server access logs for requests targeting the /server-status endpoint
• Implement alerting rules for any external IP addresses accessing diagnostic endpoints
• Review authentication logs for session anomalies indicating token theft
• Correlate /server-status access with subsequent suspicious authentication events

Monitoring Recommendations

• Configure web application firewall (WAF) rules to block or alert on /server-status access attempts
• Implement real-time log analysis for requests to sensitive administrative endpoints
• Deploy intrusion detection signatures for information disclosure attack patterns
• Establish baseline metrics for /server-status access and alert on deviations

How to Mitigate CVE-2026-35185

Immediate Actions Required

• Upgrade HAX CMS to version 25.0.0 or later immediately
• Restrict access to the /server-status endpoint at the web server or network level
• Rotate all active user tokens that may have been exposed
• Review access logs to determine if the endpoint was accessed by unauthorized parties
• Consider IP allowlisting for administrative endpoints as an additional defense layer

Patch Information

The vulnerability has been addressed in HAX CMS version 25.0.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper authentication and authorization checks on the /server-status endpoint, ensuring only authenticated administrators can access the diagnostic information.

For additional details, see the GitHub Security Advisory.

Workarounds

• Block access to /server-status at the web server level using location directives
• Implement network-level access controls to restrict endpoint access to trusted IP ranges
• Use a reverse proxy to filter requests to sensitive endpoints before they reach the application
• Disable the server status functionality entirely if not required for operations

# Example: Block /server-status endpoint in Apache configuration
<Location "/server-status">
    Require all denied
</Location>

# Example: Block /server-status endpoint in Nginx configuration
location /server-status {
    deny all;
    return 403;
}