Description
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| marcantondahmen | automad | >= 2.0.0-alpha.1, < 2.0.0-beta.28 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
lorenzocamilli/CVE-2026-45332-PoC ★ 0 · Jun 2, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure http/cves/2026/CVE-2026-45332.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | automad/automad | >= 2.0.0-alpha.1, < 2.0.0-beta.28 | 2.0.0-beta.28 | GHSA-xm76-r88j-vm3g |