CVE-2026-45332 Details
Description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
A broken access control vulnerability has been identified in Automad versions 2.0.0-alpha.1 prior to 2.0.0-beta.27. This vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hashes of all administrator accounts with a single POST request. The vulnerability exists in the publicly accessible '/_api/user-collection/create-first-user' setup endpoint, which returns full serialized user data, including password hashes and TOTP secrets, in the JSON response. The issue is present because the endpoint remains accessible after the initial configuration, exposing sensitive information to any attacker.
Users are advised to update Automad to version 2.0.0-beta.28 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Automad | >= 2.0.0-alpha.1, <= 2.0.0-beta.27 (semver) 2.0.0-beta.27 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 30, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |