CVE-2026-44828CWE-538

CVE-2026-44828

published October 13, 2026

CVSS
9.3
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2026-10-13T02:17Z
References (3)
https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33 · [email protected]https://github.com/Qexo/Qexo/releases/tag/4.2.0 · [email protected]https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232 · [email protected]
EPSS history
Timeline
  • 14 OCT 03:30Z
    EPSS moved — → 0%
    epss
  • 12 OCT 21:56Z
    Qexo initialization endpoint can reset setup state and expose stored credentials
    cvelistv5
  • 12 OCT 21:56Z
    Qexo initialization endpoint can reset setup state and expose stored credentials
    cvelistv5