CVE-2026-44828 Details
Description
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
A vulnerability in Qexo versions 4.0.0 prior to 4.2.0 allows unauthenticated access to the initialization API endpoint '/api/init_step/'. This endpoint lacks necessary authentication and authorization checks, enabling an attacker to reset the application's setup process. By sending a POST request with a valid CSRF token obtained from a public page, the attacker can initiate the setup flow, during which sensitive provider configuration data, including service credentials, may be exposed in the frontend. This vulnerability could lead to unauthorized access to third-party services connected to the Qexo instance.
Users are advised to update Qexo to version 4.2.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33 | [email protected] | Source CodeVendor |
| https://github.com/Qexo/Qexo/releases/tag/4.2.0 | [email protected] | Release NotesVendor |
| https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Qexo | >= 4.0.0, < 4.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |