Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Qexo lets anyone reset setup and reveal credentials

CVE-2026-44828 · published today
Summary

Versions of the Qexo blog editor from 4.0.0 through 4.2.0 allow anyone on the internet to call an internal setup URL without logging in. By sending a request with a token that any visitor can obtain, an attacker can restart the installation process and cause the system to display stored service passwords on a public page. Update Qexo to version 4.2.0 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qexo qexo >= 4.0.0, < 4.2.0
Original advisory text
Qexo initialization endpoint can reset setup state and expose stored credentials
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Type
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-44828 · NVD
CVE-2026-44828 · MITRE
Track software like this
Free during beta