Automad - Information Disclosure (CVE-2026-45332)
Description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
psychologyCrowdSec Analysis
CVE-2026-45332 is a high-severity broken access control vulnerability in Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27. An unauthenticated remote attacker can exploit the publicly accessible setup endpoint to retrieve bcrypt password hashes for all administrator accounts, potentially enabling offline password-cracking attacks and unauthorized administrative access.
CrowdSec has been tracking this vulnerability and its exploits since 26th of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-45332 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers first request /dashboard/login to obtain a CSRF token, then send an unauthenticated form-encoded POST to /_api/user-collection/create-first-user. Exploitation attempts include username, password1, password2, email, and __csrf__ parameters, with responses exposing passwordHash and accounts.php indicators.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-05-28 |
| Rule Released | 2026-08-26 |