Vulnerability details
CVE-2026-44828
Qexo Qexo
Qexo initialization endpoint can reset setup state and expose stored credentials
CVSS 4.0
9.3Critical
Official description
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Qexo | Qexo | >= 4.0.0, < 4.2.0 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232 x_refsource_CONFIRM
- https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33 x_refsource_MISC
- https://github.com/Qexo/Qexo/releases/tag/4.2.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-13
- Last updated
- 2026-10-13
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 21 · Low
Exploit prediction (EPSS)
0.35%
Probability of exploitation in 30 days
29.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory