{"answers":{"affected":"2 open source packages ship an affected version, including automad/automad.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45332 exists.","fix":"Upgrade automad/automad to 2.0.0-beta.28 or later.","what":"CVE-2026-45332 is a high-severity missing authorization vulnerability in marcantondahmen automad, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-45332 and fix it if it is affected.\n\nWhat it is: CVE-2026-45332 is a high-severity missing authorization vulnerability in marcantondahmen automad, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45332 exists.\n\nAffected packages and fixed versions:\n- automad/automad (Packagist): affected from 2.0.0-alpha.1; fixed in 2.0.0-beta.28\n- automad/automad (Packagist): affected from 2.0.0-alpha.1; fixed in 2.0.0-beta.28\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-45332/ (Markdown: https://insights.sbomify.com/CVE-2026-45332/index.md)","id":"CVE-2026-45332","markdown":"https://insights.sbomify.com/CVE-2026-45332/index.md","name":"CVE-2026-45332","record":{"aliases":["GHSA-xm76-r88j-vm3g"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Automad CMS","requires_auth":"none","summary":"Unauthenticated attackers can retrieve administrator password hashes and TOTP secrets via a public API endpoint, enabling account takeover.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":"2026-06-02","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":1,"refs":[{"date":"2026-06-02T17:15:09Z","kind":"github_poc","ref":"https://github.com/lorenzocamilli/CVE-2026-45332-PoC","stars":0,"title":null},{"date":null,"kind":"nuclei","ref":"http/cves/2026/CVE-2026-45332.yaml","stars":null,"title":"Automad \u003c 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure"}],"tier":"weaponised"},"has_fix":true,"headline":"Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint","id":"CVE-2026-45332","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions","id":"CVE-2026-45334"},"packages":[{"ecosystem":"Packagist","fixed":["2.0.0-beta.28"],"introduced":["2.0.0-alpha.1"],"last_affected":[],"package":"automad/automad","purl":null,"source":"GHSA-xm76-r88j-vm3g"},{"ecosystem":"Packagist","fixed":["2.0.0-beta.28"],"introduced":["2.0.0-alpha.1"],"last_affected":[],"package":"automad/automad","purl":"pkg:composer/automad/automad","source":"GHSA-xm76-r88j-vm3g"}],"prev":{"headline":"Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature","id":"CVE-2026-45331"},"products":["automad"],"published":"2026-05-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-30","vendors":["marcantondahmen"]},"summary":"Unauthenticated attackers can retrieve administrator password hashes and TOTP secrets via a public API endpoint, enabling account takeover.","url":"https://insights.sbomify.com/CVE-2026-45332/"}