Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure
CVE-2026-45332
Verified
Description
Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /_api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts, exploit requires the endpoint to remain publicly accessible after initial setup.
Severity
High
CVSS Score
7.5
Exploit Probability
1%
Affected Product
automad
Published Date
August 8, 2026
Template Author
str4k3r
CVE-2026-45332.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-45332
CWE ID:
cwe-200
Remediation Steps
Upgrade to version 2.0.0-beta.28 or later.