CVE-2026-45332 Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
Unauthenticated attackers can retrieve administrator password hashes and TOTP secrets via a public API endpoint, enabling account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45332?
CVE-2026-45332 is a high-severity missing authorization vulnerability in marcantondahmen automad, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
Which versions are affected by CVE-2026-45332?
2 open source packages ship an affected version, including automad/automad.
| Package | Affected | Fixed in |
|---|---|---|
automad/automad Packagist | From 2.0.0-alpha.1 | 2.0.0-beta.28 |
automad/automad Packagist | From 2.0.0-alpha.1 | 2.0.0-beta.28 |
How do I fix CVE-2026-45332?
Upgrade automad/automad to 2.0.0-beta.28 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45332 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45332 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xm76-r88j-vm3g.