CVE-2026-44828: Qexo initialization endpoint can reset setup state and expose stored credentials

Q: Which deployments are affected?

Qexo versions from 4.0.0 until 4.2.0 are affected. The issue is fixed in version 4.2.0.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication or authorization. They need a valid CSRF token obtainable from a public page, then can submit the first initialization step to reset the INIT setting.

Q: Can a normally configured instance be exposed after setup is complete?

Yes. The vulnerable initialization endpoint lacks a setup-completion guard, allowing an unauthenticated request to return the instance to the setup flow even after initialization.

Q: What information may be exposed?

The setup response and the /init/ page can expose stored PROVIDER configuration in frontend content, including service credentials.

Q: How can I tell whether an instance may have been affected?

Check whether the Qexo instance is running a version earlier than 4.2.0 and whether its INIT setting was reset or the setup flow became accessible unexpectedly. Review exposure of the /init/ page and setup responses for PROVIDER configuration or credentials.

Published Oct 12, 2026

Updated

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

Affected Software

1 affected component

Qexo Qexo>=4.0.0<4.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Qexo to a version that resolves this vulnerability.
Fixed in 4.2.0

Event History

Oct 12, 2026

CVE Published

via MITRE·09:56 PM

Data Sourced

via MITRE·09:56 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Qexo versions from 4.0.0 until 4.2.0 are affected. The issue is fixed in version 4.2.0.

What does an attacker need to exploit this issue?

An attacker does not need authentication or authorization. They need a valid CSRF token obtainable from a public page, then can submit the first initialization step to reset the INIT setting.

Can a normally configured instance be exposed after setup is complete?

Yes. The vulnerable initialization endpoint lacks a setup-completion guard, allowing an unauthenticated request to return the instance to the setup flow even after initialization.

What information may be exposed?

The setup response and the /init/ page can expose stored PROVIDER configuration in frontend content, including service credentials.

How can I tell whether an instance may have been affected?

Check whether the Qexo instance is running a version earlier than 4.2.0 and whether its INIT setting was reset or the setup flow became accessible unexpectedly. Review exposure of the /init/ page and setup responses for PROVIDER configuration or credentials.

CVE-2026-44828: Qexo initialization endpoint can reset setup state and expose stored credentials

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Can a normally configured instance be exposed after setup is complete?

What information may be exposed?

How can I tell whether an instance may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Can a normally configured instance be exposed after setup is complete?

What information may be exposed?

How can I tell whether an instance may have been affected?