Qexo initialization endpoint can reset setup and expose stored credentials
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Qexo, an open source online editor for static blogs, exposes /api/init_step/ through init_step_api in versions from 4.0.0 before 4.2.0 without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, returning the instance to the setup flow. The setup response and the /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. CVSS 4.0 base score 9.3 (CRITICAL), weakness CWE-538.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Qexo to version 4.2.0, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Qexo (Qexo) Fixed in 4.2.0
Timeline
- 2026-10-12 Threatist record created from CVE-2026-44828
- 2026-10-13 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences