{"action":"Upgrade @haxtheweb/haxcms-nodejs to 11.0.14 or later.","affected":[{"fixed":"11.0.14","introduced":"0"}],"component":"@haxtheweb/haxcms-nodejs","cve_ids":["CVE-2025-54378"],"ecosystem":"npm","epss":0.00531,"exploited":false,"fixed_versions":["11.0.14"],"ghsa_id":"GHSA-9jr9-8ff3-m894","id":"tcs_01M5KF04ZKZTEFZ18Z20WS4MK7","modified_at":"2026-09-10T03:50:26.000537408Z","published_at":"2025-07-25T20:10:22Z","references":["https://osv.dev/vulnerability/GHSA-9jr9-8ff3-m894","https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894","https://nvd.nist.gov/vuln/detail/CVE-2025-54378","https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969","https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-9jr9-8ff3-m894","url":"https://osv.dev/vulnerability/GHSA-9jr9-8ff3-m894"}],"summary":"HAX CMS API Lacks Authorization Checks"}