A lack of authentication and authorization on the /api/init_step/ endpoint allows an unauthenticated user, once they obtain a valid CSRF token from a public page, to submit the first initialization step. This action resets the instance's INIT setting and triggers the setup workflow to run again. During re‑initialization, the response from the setup step and the /init/ page can inadvertently reveal stored service credentials and provider configuration data to anyone retrieving the page. The weakness is a form of CWE‑538, an improper failure to encrypt or store credential data securely.

The vulnerability affects Qexo instances running version 4.0.0 through 4.1.x. Version 4.2.0, released in the Qexo 4.2.0 release, addresses the issue by removing the unauthenticated init endpoint and preventing credential leakage. All older and unpatched installations without the 4.2.0 update are considered at risk.

The CVSS score of 9.3 indicates a high severity vulnerability with potential for widespread credential compromise. Although no EPSS data is supplied and the issue is not currently listed in the CISA KEV catalog, the exposed endpoint can be used from any remote network that can access the publicly available CSRF token generator, making it a likely remote web‑based attack vector. The lack of authentication gating and no setup‑completion guard mean an attacker can repeatedly trigger the vulnerability to exfiltrate credentials, especially if the system does not enforce restrictions on the init endpoint. If exploit code becomes available, the impact could extend to full account takeover or privileged access on the target hosting environment.