CVE-2025-54378

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-54378

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54378.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-54378

Aliases

GHSA-9jr9-8ff3-m894

Published

2025-07-26T03:27:34.305Z

Modified

2026-04-02T12:57:42.210010Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Summary

HAX CMS Backend Lacks Comprehensive Authorization Checks

Details

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54378.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285",
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/haxtheweb/haxcms-nodejs

Affected ranges

Type: GIT
Repo: https://github.com/haxtheweb/haxcms-nodejs
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a8274605f58e77cd60a0b93438d016fd47d93fb6

Affected versions

10.*

10.0.0

v0.*

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v10.*

v10.0.1

v10.0.2

v10.0.3

v10.0.4

v10.0.5

v10.0.6

v11.*

v11.0.0

v11.0.1

v11.0.10

v11.0.11

v11.0.12

v11.0.13

v11.0.2

v11.0.3

v11.0.4

v11.0.5

v11.0.6

v11.0.7

v11.0.8

v11.0.9

v9.*

v9.0.0

v9.0.0-alpha.0

v9.0.0-alpha.1

v9.0.1

v9.0.10

v9.0.11

v9.0.12

v9.0.13

v9.0.14

v9.0.15

v9.0.16

v9.0.17

v9.0.18

v9.0.19

v9.0.2

v9.0.20

v9.0.21

v9.0.3

v9.0.4

v9.0.5

v9.0.6

v9.0.7

v9.0.8

v9.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54378.json"

Git / github.com/haxtheweb/haxcms-php

Affected ranges

Type: GIT
Repo: https://github.com/haxtheweb/haxcms-php
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

24d30222481ada037597c4d7c0a51a1ef7af6cfd

Affected versions

0.*

0.0.1

0.1.0

0.11.0

0.12.0

0.12.1

0.12.2

0.12.3

0.2.0

0.3.0

0.4.0

0.5.0

0.6.0

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

1.*

1.0.0

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.1

1.2.10

1.2.11

1.2.12

1.2.13

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3.0

1.3.1

1.4.0

10.*

10.0.0

10.0.3

11.*

11.0.0

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

3.*

3.0.0

4.*

4.0.0

4.1.0

5.*

5.1.0

6.*

6.0.1

7.*

7.0.1

7.0.10

7.0.13

7.0.14

7.0.15

7.0.16

7.0.2

7.0.3

8.*

8.0.0

9.*

9.0.21