CVE-2026-45332: Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

Synopsis

Broken access control in Automad (a flat-file CMS) exposes administrator bcrypt password hashes and TOTP secrets to any unauthenticated attacker. The vulnerability is reachable over the network with no credentials required, by sending a single POST request to the /_api/user-collection/create-first-user endpoint, which remains publicly accessible after initial setup and returns full serialized user data in its JSON response. Successful exploitation gives an attacker the material needed to mount offline password-cracking attempts or bypass two-factor authentication. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Automad service via HTTP/HTTPS to send the malicious POST request.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the endpoint is publicly accessible to any caller.

• Victim interactionNot required

  The attacker makes a direct API request and receives the response with no action required from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; a single well-formed POST request is sufficient with no race conditions or environmental prerequisites.

Blast Radius

• Retrieves the bcrypt password hash of every administrator account, providing offline cracking material that can yield plaintext credentials if a weak or reused password was chosen.
• Exposes TOTP secrets associated with administrator accounts, allowing an attacker to generate valid one-time codes and defeat two-factor authentication protections.
• Enables account takeover of administrator accounts, granting full control over CMS content, templates, and configuration once credentials are cracked or TOTP is bypassed.