CVE-2026-45332: Automad Unauthenticated Administrator Credential Exposure

Technical summary

This broken access control vulnerability (CWE-200, CWE-306) stems from insufficient access controls on the /_api/user-collection/create-first-user endpoint. The endpoint is designed for initial setup but fails to disable or restrict access once configuration is complete. When invoked via POST request, it returns the full serialized user collection including bcrypt password hashes for all administrator accounts. The vulnerability affects all versions from 2.0.0-alpha.1 to 2.0.0-beta.27; version 2.0.0-beta.28 and later restrict endpoint access appropriately. An attacker requires only network access to the Automad instance and can enumerate credentials without authentication or privileged credentials.

Business impact

Organizations running vulnerable Automad instances face immediate risk of administrator account compromise. Because bcrypt hashes are exposed, attackers can perform offline brute-force or dictionary attacks against administrator passwords at scale and without rate limiting. Successful compromise grants full administrative access to the CMS, enabling data theft, content manipulation, malware injection, and lateral movement within the hosting environment. The vulnerability is trivial to exploit and leaves no authentication trail, making detection difficult until after unauthorized activity occurs.

Affected systems

Automad flat-file CMS versions 2.0.0-alpha.1 through 2.0.0-beta.27 are affected. The vulnerable endpoint affects all installations that completed initial setup without subsequently patching. Later versions (2.0.0-beta.28 and beyond) have corrected the access control issue. Self-hosted and managed instances using affected versions are equally at risk; exposure depends on network accessibility to the Automad application.

Exploitability

Exploitability is very high. The attack requires no authentication, no special privileges, and no user interaction. An attacker simply sends a POST request to a known API endpoint and receives administrator password hashes in the response. The simplicity and lack of friction make this vulnerability trivial to weaponize at scale. No credential guessing, no multi-step exploitation chains, and no race conditions are required. The only limiting factor is whether the vulnerable endpoint is network-reachable.

Remediation

Upgrade to Automad version 2.0.0-beta.28 or later, which restricts access to the setup endpoint after initial configuration. Verify against the vendor advisory that your target version is included in the patched release. If immediate patching is not feasible, temporarily restrict network access to the /_api/user-collection/create-first-user endpoint at the firewall or reverse proxy layer. Additionally, assume all administrator password hashes have been exposed; force administrator password resets after patching and monitor for unauthorized administrative activity.

Patch guidance

Apply Automad version 2.0.0-beta.28 or later. Verify the patch by confirming the /_api/user-collection/create-first-user endpoint returns an access denied or authentication required response after setup completes. Test in a non-production environment first to confirm no service disruption. After patching, reset all administrator account passwords to invalidate any compromised hashes and clear session tokens to force re-authentication.

Detection guidance

Search logs for POST requests to /_api/user-collection/create-first-user from external IP ranges or during off-hours. Monitor for successful HTTP 200 responses containing user data JSON from that endpoint post-deployment. Check for bcrypt hashes ($2a$, $2b$, $2y$ prefixes) appearing in access logs or WAF logs associated with this endpoint. Correlate endpoint access with subsequent administrative login activity from unfamiliar IP addresses or unusual times. Examine Automad's internal logs for unauthorized user creation or modification events.

Why prioritize this

This vulnerability scores CVSS 7.5 (HIGH) and warrants immediate patching. The combination of zero authentication requirement, trivial exploitability, and direct exposure of administrator credentials creates urgent risk. While not yet listed on CISA's KEV catalog, the vulnerability is immediately weaponizable and requires no sophisticated attack infrastructure. Any Automad instance exposed to untrusted networks should be treated as compromised until patched and audited.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects high severity driven by network-accessible exploitation (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), high confidentiality impact (C:H), and no integrity or availability impact. The score accurately reflects the credential exposure risk but does not fully capture the post-exploitation danger of administrative account compromise. Organizations should treat this as critical if their Automad instances are internet-facing or accessible to untrusted networks.

Frequently asked questions