CVE-2026-45332
HIGHAutomad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-45332. PoCs published by lorenzocamilli.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2026-45332, demonstrating an unauthenticated credential dump vulnerability in Automad CMS. The exploit leverages a broken access control flaw in the `/_api/user-collection/create-first-user` endpoint to retrieve bcrypt password hashes and TOTP secrets of all administrator accounts.
Description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
Exploits (1)
This repository contains a functional proof-of-concept exploit for CVE-2026-45332, demonstrating an unauthenticated credential dump vulnerability in Automad CMS. The exploit leverages a broken access control flaw in the `/_api/user-collection/create-first-user` endpoint to retrieve bcrypt password hashes and TOTP secrets of all administrator accounts.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N