Qexo CVE-2026-44828

Requires a reachable Qexo instance on versions 4.0.0 through pre-4.2.0 where the /api/init_step/ endpoint (init_step_api) is exposed without the setup-completion guard; the attacker needs only a valid CSRF token, which is trivially obtained from any public page of the instance, and no authentication or prior privileges. Meaningful impact depends on the instance having already been initialized with stored PROVIDER configuration (e.g. Vercel token/project ID or image-bed credentials) so that sensitive values exist to be exposed in the setup response/ /init/ page. Limiting factors: only instances within the affected version range are vulnerable, and instances with no configured provider credentials expose little beyond the forced setup-flow reset.

The CNA-assigned CVSS 4.0 base score is 9.3 (Critical) with vector AV:N/AC:L/PR:N/UI:N, indicating a remotely reachable, low-complexity, unauthenticated flaw - all strong signals for easy exploitation. However, several real-world risk moderators apply. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. The affected product (Qexo, a niche self-hosted static-blog editor) has a small deployment footprint, which lowers the likelihood of widespread opportunistic attacks relative to the high base score. There is also an internal inconsistency in the supplied CVSS 4.0 vector worth verifying: it sets vulnerable-system integrity/availability to none (VI:N/VA:N) while rating subsequent-system impacts high (SC:H/SI:H/SA:H), yet the description's core behaviors - resetting the INIT setting and forcing re-entry into the setup flow - are modifications to the vulnerable system itself, which would normally register as vulnerable-system integrity impact. The confirmed, high-confidence risk is unauthenticated disclosure of stored PROVIDER service credentials (CWE-538), a genuine priority for any exposed instance, but the practical blast radius is bounded by the product's limited prevalence and the requirement that provider credentials already be configured.

An unauthenticated attacker fetches a valid CSRF token from any public Qexo page, then POSTs the first initialization step to the unguarded /api/init_step/ endpoint, resetting the instance's INIT state and forcing it back into the setup flow. The attacker then loads the /init/ page or reads the setup response, which renders stored PROVIDER configuration (e.g. service/deployment credentials) in frontend content. No public exploit was identified at time of analysis, but the GitHub Security Advisory and fix commit are public, making the flaw straightforward to reproduce.