HAXiam, a CMS managing microsites with PHP or NodeJs backends, had an access control flaw in versions before 25.0.0 where the /server-status endpoint was publicly accessible. This endpoint leaked sensitive data including user authentication tokens (user_token), user activity logs, client IP addresses, and server configuration details. Such exposure violates proper access control (CWE-284) and leads to information disclosure (CWE-522, CWE-532). The vulnerability is addressed by restricting access to this endpoint starting with version 25.0.0.

Unauthenticated attackers can access the /server-status endpoint to obtain sensitive information such as authentication tokens, user activity, client IPs, and server configuration. This can lead to privacy violations and facilitate further attacks by revealing internal infrastructure details. The CVSS v4.0 score is 8.7 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on information confidentiality and integrity.

Upgrade HAXiam to version 25.0.0 or later, where the /server-status endpoint is no longer publicly accessible. Patch status is confirmed by the vendor stating the vulnerability is fixed in 25.0.0. No additional mitigation is required if the system is updated.