7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45332

CVE-2026-45332: Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45332

CVE-2026-45332:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
automad/automad	composer	>= 2.0.0-alpha.1, <= 2.0.0-beta.27	2.0.0-beta.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists due to a broken access control flaw in the /_api/user-collection/create-first-user API endpoint, which is handled by the Automad\Controllers\API\UserCollectionController::createFirstUser function. This endpoint was designed for the initial setup of the first administrator account but failed to disable itself after completion. As a result, an unauthenticated attacker could call this endpoint on a fully configured system. The function would proceed to load all user accounts via UserCollection. When preparing the response, it serializes these user objects. The Automad\Auth\User::__serialize method includes the passwordHash and totpSecret in the serialized data. This serialized data, containing sensitive credential information for all administrators, was then returned in the JSON response to the attacker. The patch mitigates this by adding a check at the beginning of createFirstUser to verify if any user accounts already exist. If they do, the function immediately terminates with a 403 Forbidden error, preventing the information disclosure.

Vulnerable functions

Automad\Controllers\API\UserCollectionController::createFirstUser

automad/src/server/Controllers/API/UserCollectionController.php

This public API endpoint was intended for initial user setup but remained accessible after accounts were created. An attacker could make an unauthenticated POST request to this endpoint, which would then load and return all existing user data, including sensitive information like password hashes and TOTP secrets. The patch adds a check to ensure this function exits if user accounts already exist.

Automad\Auth\User::__serialize

automad/src/server/Auth/User.php

This function is responsible for serializing User objects. It includes the sensitive 'passwordHash' and 'totpSecret' fields in the serialized output. When the vulnerable 'createFirstUser' endpoint is called, it triggers the serialization of all user objects, causing this function to be executed and exposing the sensitive data in the API response.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.