Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Qexo by Qexo
CVE-2026-44828 (GCVE-0-2026-44828)
Vulnerability from nvd – Published: 2026-10-12 21:56 – Updated: 2026-10-13 20:23
VLAI
EPSS
VEX
Title
Qexo initialization endpoint can reset setup state and expose stored credentials
Summary
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:19 UTC
CWE
- CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Qexo/Qexo/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/Qexo/Qexo/commit/3782750c2d90b… | x_refsource_MISC |
| https://github.com/Qexo/Qexo/releases/tag/4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:19:05.631460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:23:19.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Qexo",
"vendor": "Qexo",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-538",
"description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:56:35.696Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232"
},
{
"name": "https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33"
},
{
"name": "https://github.com/Qexo/Qexo/releases/tag/4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Qexo/Qexo/releases/tag/4.2.0"
}
],
"source": {
"advisory": "GHSA-qfv8-hj33-4232",
"discovery": "UNKNOWN"
},
"title": "Qexo initialization endpoint can reset setup state and expose stored credentials"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44828",
"datePublished": "2026-10-12T21:56:35.696Z",
"dateReserved": "2026-05-07T21:21:48.351Z",
"dateUpdated": "2026-10-13T20:23:19.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44828 (GCVE-0-2026-44828)
Vulnerability from cvelistv5 – Published: 2026-10-12 21:56 – Updated: 2026-10-13 20:23
VLAI
EPSS
VEX
Title
Qexo initialization endpoint can reset setup state and expose stored credentials
Summary
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 20:19 UTC
CWE
- CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Qexo/Qexo/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/Qexo/Qexo/commit/3782750c2d90b… | x_refsource_MISC |
| https://github.com/Qexo/Qexo/releases/tag/4.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44828",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T20:19:05.631460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:23:19.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Qexo",
"vendor": "Qexo",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-538",
"description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:56:35.696Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232"
},
{
"name": "https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33"
},
{
"name": "https://github.com/Qexo/Qexo/releases/tag/4.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Qexo/Qexo/releases/tag/4.2.0"
}
],
"source": {
"advisory": "GHSA-qfv8-hj33-4232",
"discovery": "UNKNOWN"
},
"title": "Qexo initialization endpoint can reset setup state and expose stored credentials"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44828",
"datePublished": "2026-10-12T21:56:35.696Z",
"dateReserved": "2026-05-07T21:21:48.351Z",
"dateUpdated": "2026-10-13T20:23:19.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}