Critical 9.3Published Oct 12, 2026

CVE-2026-44828Qexo initialization endpoint can reset setup state and expose stored credentials

Updated under an hour ago (2026-10-19 05:50 UTC)

Does this affect you?

It affects Qexo. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.36%, higher than 28% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Qexo

Exploited in the last 30 days

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

CVSS: 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness (CWE): CWE-538
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.36% (percentile 28)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 13, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Qexo Qexo qexo:qexo (from the name)	from 4.0.0, < 4.2.0	CNA record

References

https://github.com/Qexo/Qexo/security/advisories/GHSA-qfv8-hj33-4232x-refsource-confirm
https://github.com/Qexo/Qexo/commit/3782750c2d90bf145b88edab443e82f5545a2d33x-refsource-misc
https://github.com/Qexo/Qexo/releases/tag/4.2.0x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.