Compliance Impact

This vulnerability exposes sensitive administrator credentials, including bcrypt password hashes and TOTP secrets, to unauthenticated attackers via a publicly accessible API endpoint.

Such exposure of sensitive authentication data can lead to unauthorized access and potential data breaches, which may violate common standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.

The disclosure of administrator credentials and server directory information increases the risk of non-compliance with these regulations due to inadequate access controls and failure to protect sensitive data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45332 is a Broken Access Control vulnerability in the Automad CMS versions 2.0.0-alpha.1 to 2.0.0-beta.27. It allows unauthenticated attackers to retrieve sensitive administrator credentials by sending a crafted POST request to the public API endpoint /_api/user-collection/create-first-user.

This endpoint remains accessible even after the initial setup is complete and returns serialized user data, including bcrypt password hashes and TOTP secrets of all administrator accounts, as well as the server's filesystem path.

The vulnerability arises from improper access controls and serialization logic in the UserCollectionController.php and User.php files, exposing administrator credentials without requiring authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including the exposure of bcrypt password hashes and TOTP secrets of all administrator accounts.

Attackers can perform offline brute-force attacks on the password hashes to recover weak passwords.

If passwords are recovered, attackers can bypass two-factor authentication, gaining full administrative access.

Additionally, the disclosure of the server's filesystem path can aid attackers in further exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the vulnerable Automad CMS version (2.0.0-alpha.1 to 2.0.0-beta.27) is running and if the endpoint /_api/user-collection/create-first-user is publicly accessible.

Detection involves sending a crafted POST request to the /_api/user-collection/create-first-user endpoint and observing if the response contains serialized user data including bcrypt password hashes and TOTP secrets.

A sample command using curl to test this would be:

• curl -X POST https://your-automad-site.com/_api/user-collection/create-first-user -v

If the response returns JSON data with administrator password hashes or other sensitive information, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Automad CMS to version 2.0.0-beta.28 or later, where this vulnerability has been fixed.

Until the update can be applied, restrict access to the /_api/user-collection/create-first-user endpoint by implementing network-level controls such as firewall rules or web server access restrictions to prevent unauthenticated access.

Additionally, review administrator accounts for any suspicious activity and consider resetting administrator passwords after patching.

Useful 0 Not Useful 0