CVE-2026-45332
Information Disclosure in Automad CMS
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| automad | automad | 2.0.0-beta.28 |
| automad | automad | From 2.0.0-alpha.1 (inc) to 2.0.0-beta.28 (exc) |
| marcantondahmen | automad | From 2.0.0-alpha.1 (inc) to 2.0.0-beta.27 (inc) |
| marcantondahmen | automad | 2.0.0-beta.28 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-45332 is a Broken Access Control vulnerability in the Automad CMS versions 2.0.0-alpha.1 to 2.0.0-beta.27. It allows unauthenticated attackers to retrieve sensitive administrator credentials by sending a crafted POST request to the public API endpoint /_api/user-collection/create-first-user.
This endpoint remains accessible even after the initial setup is complete and returns serialized user data, including bcrypt password hashes and TOTP secrets of all administrator accounts, as well as the server's filesystem path.
The vulnerability arises from improper access controls and serialization logic in the UserCollectionController.php and User.php files, exposing administrator credentials without requiring authentication.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including the exposure of bcrypt password hashes and TOTP secrets of all administrator accounts.
Attackers can perform offline brute-force attacks on the password hashes to recover weak passwords.
If passwords are recovered, attackers can bypass two-factor authentication, gaining full administrative access.
Additionally, the disclosure of the server's filesystem path can aid attackers in further exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the vulnerable Automad CMS version (2.0.0-alpha.1 to 2.0.0-beta.27) is running and if the endpoint /_api/user-collection/create-first-user is publicly accessible.
Detection involves sending a crafted POST request to the /_api/user-collection/create-first-user endpoint and observing if the response contains serialized user data including bcrypt password hashes and TOTP secrets.
A sample command using curl to test this would be:
- curl -X POST https://your-automad-site.com/_api/user-collection/create-first-user -v
If the response returns JSON data with administrator password hashes or other sensitive information, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update Automad CMS to version 2.0.0-beta.28 or later, where this vulnerability has been fixed.
Until the update can be applied, restrict access to the /_api/user-collection/create-first-user endpoint by implementing network-level controls such as firewall rules or web server access restrictions to prevent unauthenticated access.
Additionally, review administrator accounts for any suspicious activity and consider resetting administrator passwords after patching.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes sensitive administrator credentials, including bcrypt password hashes and TOTP secrets, to unauthenticated attackers via a publicly accessible API endpoint.
Such exposure of sensitive authentication data can lead to unauthorized access and potential data breaches, which may violate common standards and regulations like GDPR and HIPAA that require protection of personal and sensitive information.
The disclosure of administrator credentials and server directory information increases the risk of non-compliance with these regulations due to inadequate access controls and failure to protect sensitive data.