CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials
Unauthenticated attackers can reset the setup state and expose stored service credentials via an unprotected initialization endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44828?
CVE-2026-44828 is a critical missing authorization vulnerability in Qexo, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
Weakness: CWE-538
Which versions are affected by CVE-2026-44828?
How do I fix CVE-2026-44828?
No fix has been published for CVE-2026-44828 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44828 being exploited?
There is no known exploitation of CVE-2026-44828 in the wild and no public exploit code.
Sources
Also known as GHSA-qfv8-hj33-4232.