Automad is a flat‑file content management system that suffered a broken access control flaw in versions 2.0.0‑alpha.1 through 2.0.0‑beta.27. The flaw allows any unauthenticated user to send a single POST request to the public /_api/user‑collection/create‑first‑user endpoint and receive the full serialized user data in the JSON response, including bcrypt password hashes for all administrator accounts and their TOTP secrets. The CVE description does not state an offline cracking capability, but based on the disclosure of hashes and TOTP secrets it is inferred that attackers could attempt offline password cracking or use the secrets for further attacks.

The vulnerability affects the Automad product from the vendor marcantondahmen. Affected releases are 2.0.0‑alpha.1 up to and including 2.0.0‑beta.27.

The flaw carries a CVSS score of 7.5, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: a remote attacker can issue an unauthenticated POST request over the network to the exposed API endpoint and retrieve sensitive credentials without any prior access.