High severity7.5GHSA Advisory· Published May 28, 2026· Updated Jun 1, 2026
CVE-2026-45332
CVE-2026-45332
Description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
automad/automadPackagist | >= 2.0.0-alpha.1, < 2.0.0-beta.28 | 2.0.0-beta.28 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.