PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45332 marcantondahmen CVE debrief

Automad flat-file CMS versions 2.0.0-alpha.1 through 2.0.0-beta.27 contain a Broken Access Control vulnerability that allows unauthenticated attackers to retrieve bcrypt password hashes for all administrator accounts via a single POST request to the `/_api/user-collection/create-first-user` endpoint. This setup endpoint remains publicly accessible after initial configuration and returns full serialized user data including password hashes in its JSON response. The vulnerability was published on 2026-05-28 and is fixed in version 2.0.0-beta.28.

Vendor
marcantondahmen
Product
automad
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-01
Advisory published
2026-05-28
Advisory updated
2026-06-01

Who should care

Organizations running Automad CMS versions 2.0.0-alpha.1 through 2.0.0-beta.27; security teams responsible for content management system security; administrators of flat-file CMS deployments; penetration testers and bug bounty programs evaluating Automad installations

Technical summary

The vulnerability exists in Automad's user creation API endpoint `/_api/user-collection/create-first-user`, which is intended for initial setup but remains accessible after configuration completion. The endpoint accepts POST requests without authentication and returns complete serialized user objects including bcrypt password hashes in the JSON response body. This represents a failure to implement proper access controls (CWE-306) and information exposure (CWE-200). The flat-file architecture of Automad means user data is stored in the filesystem, and the API's response structure leaks this sensitive credential material to unauthenticated network attackers.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Automad to version 2.0.0-beta.28 or later to remediate this vulnerability
  • If immediate patching is not possible, restrict network access to the `/_api/user-collection/create-first-user` endpoint at the web server or WAF level
  • Review access logs for POST requests to `/_api/user-collection/create-first-user` that may indicate exploitation attempts
  • Rotate all administrator passwords after patching, as bcrypt hashes may have been exposed
  • Verify that setup endpoints are properly disabled or access-controlled after initial system configuration

Evidence notes

The CVE description and GitHub Security Advisory confirm the affected version range (2.0.0-alpha.1 to 2.0.0-beta.27) and the specific endpoint (`/_api/user-collection/create-first-user`) that exposes administrator password hashes. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) supports the HIGH severity rating with a base score of 7.5.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45332 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45332

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45332 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45332

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.