Qexo
Monthly
Qexo instances running versions 4.0.0 through any release before 4.2.0 expose the /api/init_step/ initialization endpoint without authentication or a setup-completion guard, allowing an unauthenticated attacker who supplies a CSRF token harvested from any public page of the instance to restart the setup flow and, in the same interaction, read back stored PROVIDER configuration such as service credentials. The CNA rates this 9.3 (Critical, CVSS 4.0) while our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the integrity impact is a forced re-entry into initialization rather than arbitrary data modification, and that the confidentiality loss only materializes on instances that have already stored provider secrets (for example a Vercel token or image-bed credentials). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Qexo 4.2.0.
Qexo instances running versions 4.0.0 through any release before 4.2.0 expose the /api/init_step/ initialization endpoint without authentication or a setup-completion guard, allowing an unauthenticated attacker who supplies a CSRF token harvested from any public page of the instance to restart the setup flow and, in the same interaction, read back stored PROVIDER configuration such as service credentials. The CNA rates this 9.3 (Critical, CVSS 4.0) while our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the integrity impact is a forced re-entry into initialization rather than arbitrary data modification, and that the confidentiality loss only materializes on instances that have already stored provider secrets (for example a Vercel token or image-bed credentials). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Qexo 4.2.0.