CVE-2026-45332

High

Description

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

SeverityHigh

CVSS7.5

Exploit probability—

ProductAutomad/automad

PublishedMay 28, 2026

First seenMay 28, 2026

Weakness typeCWE-200Sensitive information exposure CWE-306Missing authentication for critical function

How to fix

Update

automad/automad2.0.0-beta.28 or later

Affected products

Product	Affected versions	Fixed in
automad/automadPackagist	2.0.0-alpha.1 ≤ v < 2.0.0-beta.28	2.0.0-beta.28

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.