CVE-2026-45332
1 advisory.
Packagist/automad/automad CVE-2026-45332: high 7.5
Automad has Broken Access Control: Unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint
Action: Upgrade automad/automad to 2.0.0-beta.28 or later.
composer require automad/automad:2.0.0-beta.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-alpha.1 | 2.0.0-beta.28 | - |
Fixed versions
| 2.0.0-beta.28 |
Sources
- osv: GHSA-xm76-r88j-vm3g
- https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g
- https://nvd.nist.gov/vuln/detail/CVE-2026-45332
- https://github.com/marcantondahmen/automad
CVE-2026-45332 · published · modified · JSON