PT-2026-44152 · Automad · Automad

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-45332

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27

Description A broken access control issue allows an unauthenticated attacker to retrieve the bcrypt password hashes of all administrator accounts via a single POST request. The setup endpoint "/ api/user-collection/create-first-user" remains publicly accessible after the initial configuration is finished and returns full serialized user data in the JSON response body. This exposure includes the absolute filesystem path to the configuration directory. In version 2.0.0-beta.27, the response also includes the TOTP (Time-based One-Time Password) secret, which could allow an attacker to bypass two-factor authentication if a plaintext password is recovered through offline brute-force or dictionary attacks on the exposed bcrypt hashes.

Recommendations Update to version 2.0.0-beta.28 or later.

Fix

Information Disclosure

Missing Authentication

Weakness Enumeration

CWE-200

CWE-306

Related Identifiers

CVE-2026-45332

GHSA-XM76-R88J-VM3G

Affected Products

Automad

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-45332 · Security Note
• https://osv.dev/vulnerability/GHSA-xm76-r88j-vm3g · Vendor Advisory
• https://github.com/marcantondahmen/automad · Note
• https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g · Note
• https://twitter.com/CVEnew/status/2060091958966530129 · Twitter Post