CVE-2026-55445
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in Qinglong before version 2.20.1 allows an unauthenticated attacker to reset administrator credentials. The init guard middleware does not cover the /open/user/init path, which is rewritten after JWT authentication, enabling an attack via a PUT request.
Risk Assessment
The risk is that an unauthenticated attacker can gain full control over an initialized Qinglong instance, leading to unauthorized task management access and potential system compromise.
Recommendation
Immediately upgrade Qinglong to version 2.20.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.