Automad, a flat-file CMS and template engine, has a broken access control vulnerability (CWE-200, CWE-306) in versions >= 2.0.0-alpha.1 and < 2.0.0-beta.28. The /_api/user-collection/create-first-user endpoint remains publicly accessible after initial setup, allowing unauthenticated attackers to retrieve full serialized user data including bcrypt password hashes of all administrator accounts with a single POST request. This exposure of sensitive information can facilitate offline password cracking. The issue is resolved in version 2.0.0-beta.28.

An unauthenticated attacker can obtain bcrypt password hashes of all administrator accounts, potentially enabling offline password cracking and unauthorized access if passwords are weak. The vulnerability does not allow direct modification or denial of service but compromises credential confidentiality. No known exploits in the wild have been reported.

Upgrade Automad to version 2.0.0-beta.28 or later, where this vulnerability is fixed. Since this is a self-hosted product, users must apply the update themselves. Patch status is not explicitly stated in the vendor advisory but the description confirms the fix in 2.0.0-beta.28. Until patched, restrict access to the /_api/user-collection/create-first-user endpoint if possible.