CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks
Attackers can access or modify resources without proper permission checks because HAX CMS API endpoints fail to verify user authorization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54378?
CVE-2025-54378 is a high-severity missing authorization vulnerability in haxtheweb issues, published on 26 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.
Which versions are affected by CVE-2025-54378?
4 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs and elmsln/haxcms. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.14 |
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.14 |
elmsln/haxcms Packagist | All versions | 11.0.14 |
elmsln/haxcms Packagist | All versions | 11.0.14 |
Products include Psu Haxcms-Nodejs, Psu Haxcms-Php.
How do I fix CVE-2025-54378?
Upgrade @haxtheweb/haxcms-nodejs to 11.0.14 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-54378 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54378 exists.
Other vulnerabilities in haxtheweb issues
- CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability
- CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
- CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets
Sources
Also known as GHSA-9jr9-8ff3-m894.