Unauthenticated access to the gitlist plugin in HAX CMS versions 2.0.0 through 25.x permits an attacker to view the entire repository and commit history. The exposure allows disclosure of source code, configuration files, and other sensitive data that should be protected, representing a classic authorisation bypass (CWE‑639).

The vulnerability affects HAX CMS for PHP distributed by HaxTheWeb. All releases from 2.0.0 up to, but not including, 26.0.0 are impacted; version 26.0.0 and later contain the fix.

The CVSS score of 6.9 indicates moderate severity. Because the issue provides direct read access to source code without authentication, exploitation is straightforward for anyone who can reach the CMS over the network. EPSS data is not available, and the vulnerability is not listed in CISA KEV. While it does not grant code execution, the information obtained can facilitate subsequent attacks such as credential theft or the development of more targeted exploits.