CVE-2026-111650

8.6High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.6High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-306

Impact

Unauthenticated remote attackers can hijack your storage and overwrite site and map settings by hitting exposed setup wizard endpoints. They only need network access to reach the web instance to redirect uploads and reads to an attacker-controlled S3 or OpenList provider.

Root cause

The `/server/api/wizard/` endpoints lack authentication checks, allowing configuration handlers to remain accessible even after initial setup is complete.

Affected systems

ChronoFrame through 1.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Fix & remediation

Upgrade to a version newer than 1.0.0 once released. As an immediate workaround, block all external requests to `/api/wizard/*` at your reverse proxy or web application firewall.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111650