CVE-2026-46511: HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

Synopsis

This is a stored cross-site scripting (XSS) combined with token-leaking API vulnerability in HAXcms (both the Node.js and PHP backends). An authenticated attacker with any low-privilege account plants a malicious script that, when a victim loads the affected page, silently calls the /system/api/connectionSettings endpoint and extracts four authentication tokens exposed in the global window.appSettings JavaScript variable. Successful exploitation gives the attacker full control of the victim's session, enabling complete cross-tenant account takeover. No fix has been published yet; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the HAXcms service over the network to plant the stored XSS payload and to trigger the /system/api/connectionSettings token-leaking endpoint.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs a valid login to inject the malicious script into stored content.

• Victim interactionNot required

  No victim interaction beyond normal browsing is needed; the malicious script executes silently when a victim loads the page containing the injected payload.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required to complete the attack chain.

Blast Radius

• Reads all four active session authentication tokens (jwt, user_token, site_token, and appstore_token) from the victim's browser and exfiltrates them to an attacker-controlled endpoint.
• Takes over the victim's authenticated session, giving the attacker the same privileges as the compromised account across all tenants accessible to that account.
• Modifies or deletes site content and configuration within any tenant the victim can access, because the stolen tokens authenticate all write operations.
• Crashes or corrupts microsite environments the victim manages by issuing authenticated destructive API calls using the exfiltrated tokens.