Qexo: Missing authentication in init endpoint allows setup reset and credential exposure

Summary

Qexo, an open source online editor for static blogs, exposes the /api/init_step/ endpoint without authentication or a check that setup is complete. An unauthenticated attacker who obtains a valid CSRF token from a public page can submit the first initialization step and reset the INIT setting, sending the instance back into the setup flow. The setup response and the /init/ page can also expose stored PROVIDER configuration, including service credentials.

Affected

• Qexo 4.0.0 up to, but not including, 4.2.0

Fixed in

• Fixed in Qexo 4.2.0

Workaround

• Unknown. The vendor documents no workaround.
• Restrict access to /init/ and /api/init_step/ at the reverse proxy or firewall, or allow only administrator IP addresses, until the instance is upgraded.

Exploitation

• No evidence of exploitation in the wild found. CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept found.

Our recommendation

• Identify all Qexo instances, including Docker or third-party images, and their versions.
• Upgrade to Qexo 4.2.0 or later.
• Review access logs for requests to /init/ and /api/init_step/.
• Rotate all stored provider and service credentials if an affected instance was reachable from the internet.
• Confirm that the INIT state is correct and that the setup flow is not reachable.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Qexo fix commit 3782750 github.com
• Qexo release 4.2.0 github.com
• GHSA-qfv8-hj33-4232 security advisory github.com
• OSV entry CVE-2026-44828 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:24.