CVE-2026-45332Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-05-28); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot59d
Disclosure
🚨 CVE-2026-45332 - high 🚨 Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure > Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-45332 @pdnuclei #NucleiTemplat...
Post summary
The tweet announces CVE-2026-45332 affecting Automad versions below 2.0.0-beta.28, notes an unauthenticated admin password hash disclosure, and links to further information, but does not mention exploitation, patches, or a false positive.
00022282
1.3K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-45332 Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthentic… https://www.cve.org/CVERecord?id=CVE-2026-45332
Post summary
The statement discloses a Broken Access Control vulnerability (CVE‑2026‑45332) in Automad versions 2.0.0‑alpha.1 through 2.0.0‑beta.27, noting the affected range without mentioning any PoC, exploit, patch, or active exploitation.
00000143
57.5K followersView on X

Explore more

Back to dashboard