CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

EUVD-2026-97979

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828 Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

The open-source static blog editor Qexo versions 4.0.0 through 4.2.0 is vulnerable to an authentication bypass in the init_step_api component. The /api/init_step/ endpoint lacks proper authorization and a setup-completion guard, allowing an unauthenticated requester with a valid CSRF token to res...

CVE-2026-44828: Insertion of Sensitive Information into Externally-Accessible File or Directory

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

PT-2026-110983

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init step/ through init step api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the fir...