CVE-2026-111650 Details
Description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
A missing authentication vulnerability has been identified in ChronoFrame versions through 1.0.0. The issue resides in the server/api/wizard/ handlers, where unauthenticated attackers can reconfigure already set up instances. By sending a POST request to /api/wizard/storage, attackers can activate an S3 or OpenList storage provider of their choice, redirecting uploads and storage reads to their controlled environment. Additionally, this vulnerability allows overwriting of site and map settings.
The vulnerability can be remediated by adding authentication checks to the wizard API handlers on the server. Once the first user is set up, require an authenticated admin session for all wizard routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/HoshinoSuzumi/chronoframe | [email protected] | ProductSource CodeVendor |
| https://github.com/HoshinoSuzumi/chronoframe/blob/v1.0.0/server/api/wizard/storage.post.ts#L1-L26 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/chronoframe-through-1.0.0-missing-authentication-via-setup-wizard-api | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChronoFrame | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |