CVE-2026-44828

UNKNOWN 0.0

Qexo initialization endpoint can reset setup state and expose stored credentials

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

CWE	CWE-538
Vendor	qexo
Product	qexo
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for qexo qexo

Be the first to know when new unknown vulnerabilities affecting qexo qexo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Qexo / Qexo

>= 4.0.0, < 4.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232 github.com: https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33 github.com: https://github.com/Qexo/Qexo/releases/tag/4.2.0