Vulnerability-Lookup

CVE-2026-45332 (GCVE-0-2026-45332)

Vulnerability from cvelistv5 – Published: 2026-05-28 18:22 – Updated: 2026-05-30 02:10

Title

Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Summary

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/marcantondahmen/automad/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
marcantondahmen	automad	Affected: >= 2.0.0-alpha.1, < 2.0.0-beta.28

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45332",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-30T02:09:45.441275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-30T02:10:27.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "automad",
          "vendor": "marcantondahmen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-alpha.1, \u003c 2.0.0-beta.28"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T18:22:11.883Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g"
        }
      ],
      "source": {
        "advisory": "GHSA-xm76-r88j-vm3g",
        "discovery": "UNKNOWN"
      },
      "title": "Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45332",
    "datePublished": "2026-05-28T18:22:11.883Z",
    "dateReserved": "2026-05-11T20:50:30.540Z",
    "dateUpdated": "2026-05-30T02:10:27.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45332",
      "date": "2026-06-02",
      "epss": "0.00044",
      "percentile": "0.14005"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45332\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-28T19:16:39.133\",\"lastModified\":\"2026-06-01T18:50:57.210\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45332\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-30T02:09:45.441275Z\"}}}], \"references\": [{\"url\": \"https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-30T02:10:20.166Z\"}}], \"cna\": {\"title\": \"Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint\", \"source\": {\"advisory\": \"GHSA-xm76-r88j-vm3g\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"marcantondahmen\", \"product\": \"automad\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.0.0-alpha.1, \u003c 2.0.0-beta.28\"}]}], \"references\": [{\"url\": \"https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\", \"name\": \"https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-28T18:22:11.883Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45332\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-30T02:10:27.586Z\", \"dateReserved\": \"2026-05-11T20:50:30.540Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-28T18:22:11.883Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45332

Vulnerability from fkie_nvd - Published: 2026-05-28 19:16 - Updated: 2026-06-01 18:50

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28."
    }
  ],
  "id": "CVE-2026-45332",
  "lastModified": "2026-06-01T18:50:57.210",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-28T19:16:39.133",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XM76-R88J-VM3G

Vulnerability from github – Published: 2026-05-27 21:32 – Updated: 2026-05-27 21:32

Summary

Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Details

Summary

A Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body.

Details

Affected version: - bcrypt hash exposure: >= 2.0.0-alpha.1, <= 2.0.0-beta.27 - TOTP secret exposure: only 2.0.0-beta.27

Impact

Any Automad installation reachable over HTTP is at risk no prior account, credentials, or special network position are required to exploit this vulnerability.

Potential impacts include:

Credential hash exposure enabling offline brute-force or dictionary attacks: bcrypt password hashes for every administrator are returned in a single unauthenticated response. While hashes are not plaintext passwords, the salt embedded in the hash is not secret it is visible in the response. Administrators using common or weak passwords are at direct risk of having their plaintext password recovered.
TOTP secret exposure: The TOTP secret is included in the response starting with version 2.0.0-beta.27, the first release introducing TOTP-based two-factor authentication. If an attacker successfully recovers a plaintext password, two-factor authentication can be bypassed entirely. Only version 2.0.0-beta.27 is affected by this specific issue.
Information disclosure: The response discloses the absolute filesystem path to the configuration directory. While the directory structure is publicly documented, the absolute server path may expose environment-specific information.

Remediation

Update to version 2.0.0-beta.28 or later.

This issue was reported privately and fixed prior to public disclosure.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0-beta.27"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "automad/automad"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-alpha.1"
            },
            {
              "fixed": "2.0.0-beta.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-27T21:32:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n A Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The `/_api/user-collection/create-first-user` setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body.  \n\n### Details\n\nAffected version: \n - bcrypt hash exposure: `\u003e= 2.0.0-alpha.1, \u003c= 2.0.0-beta.27`\n - TOTP secret exposure: only `2.0.0-beta.27`\n\n### Impact\n\nAny Automad installation reachable over HTTP is at risk no prior account, credentials, or special network position are required to exploit this vulnerability.\n\nPotential impacts include:\n\n- **Credential hash exposure enabling offline brute-force or dictionary attacks:** \n  bcrypt password hashes for every administrator are returned in a single unauthenticated response. While hashes are not plaintext passwords, the salt embedded in the hash is not secret it is visible in the response. Administrators using common or weak passwords are at direct risk of having their plaintext password recovered.\n- **TOTP secret exposure:** \n  The TOTP secret is included in the response starting with version `2.0.0-beta.27`, the first release introducing TOTP-based two-factor authentication. If an attacker successfully recovers a plaintext password, two-factor authentication can be bypassed entirely. *Only version `2.0.0-beta.27` is affected by this specific issue.*  \n- **Information disclosure:** \n  The response discloses the absolute filesystem path to the configuration directory. While the directory structure is publicly documented, the absolute server path may expose environment-specific information.\n\n## Remediation\n\nUpdate to version 2.0.0-beta.28 or later.\n\nThis issue was reported privately and fixed prior to public disclosure.",
  "id": "GHSA-xm76-r88j-vm3g",
  "modified": "2026-05-27T21:32:31Z",
  "published": "2026-05-27T21:32:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/marcantondahmen/automad"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-45332 (GCVE-0-2026-45332)

FKIE_CVE-2026-45332

GHSA-XM76-R88J-VM3G

Summary

Details

Impact

Remediation

Tags

Sightings

Nomenclature