CVE-2026-44828

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44828

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44828.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44828

Aliases

GHSA-qfv8-hj33-4232

Published

2026-10-12T21:56:35Z

Modified

2026-10-15T02:30:44Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

Qexo initialization endpoint can reset setup state and expose stored credentials

Details

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-538"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44828.json"
}

References

Affected packages

Git / github.com/qexo/qexo

Affected ranges

Type

GIT

Repo

https://github.com/qexo/qexo

Events

Introduced

5f70ed9569c9001b9282c61f2c0edc7b039092f3

Fixed

3782750c2d90bf145b88edab443e82f5545a2d33

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.2.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.0.0

4.0.1

4.1.0

4.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44828.json"