CVE-2026-44828

Received Received - Intake

Qexo Unauthenticated Setup Reset Exposes Credentials

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-44828

Affected Vendors & Products

Vendor	Product	Version / Range
Qexo	Qexo	>= 4.0.0, < 4.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Attack-Flow Graph

Executive Summary

Qexo versions 4.0.0 to 4.2.0 have an unauthenticated API endpoint /api/init_step/ that allows an attacker with a valid CSRF token to reset the setup process. This can expose stored service credentials and configuration details in frontend content.

Detection Guidance

Check if your Qexo instance is running a version between 4.0.0 and 4.2.0. Verify if /api/init_step/ is accessible without authentication by sending a request to the endpoint. Look for exposed sensitive configuration data in responses or frontend content.

Impact Analysis

An attacker could gain access to sensitive service credentials and configuration, potentially leading to unauthorized access or data breaches. The exposure of these details could allow further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations and legal consequences.

Mitigation Strategies

Upgrade Qexo to version 4.2.0 or later immediately. Ensure proper authentication and authorization are enforced on all API endpoints. Review and restrict access to sensitive configuration data exposed in frontend content.

Hi! I’m here to help you understand CVE-2026-44828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70