CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

The open-source static blog editor Qexo versions 4.0.0 through 4.2.0 is vulnerable to an authentication bypass in the init_step_api component. The /api/init_step/ endpoint lacks proper authorization and a setup-completion guard, allowing an unauthenticated requester with a valid CSRF token to res...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...