Automad, a flat-file CMS and template engine, suffers from a broken access control vulnerability (CWE-200, CWE-306) in versions >= 2.0.0-alpha.1 and < 2.0.0-beta.28. The issue is that the setup endpoint /_api/user-collection/create-first-user remains publicly accessible after initial setup, allowing unauthenticated attackers to send a single POST request and receive full serialized user data, including bcrypt password hashes of all administrator accounts. This exposure of sensitive information can facilitate further attacks if hashes are cracked. The vulnerability is resolved in version 2.0.0-beta.28.

An unauthenticated attacker can retrieve bcrypt password hashes of all administrator accounts, exposing sensitive authentication data. This could lead to offline password cracking attempts and potential unauthorized access if hashes are compromised. The vulnerability does not directly allow modification or denial of service but compromises confidentiality of administrator credentials.

Upgrade Automad to version 2.0.0-beta.28 or later, where this vulnerability is fixed. There is no indication of any temporary workaround or alternative mitigation. Users should apply the official fix promptly to prevent unauthorized disclosure of administrator password hashes.