{"id":"CVE-2026-108121","kind":"vulnerability","aliases":["CVE-2026-108121"],"related":[],"title":"SME Server: domain creation lets admins corrupt Apache config, blocking web startup","description":"Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's \nSME Server version 11.0rc1-215, allowing an attacker with high privileges \nto inject reserved Apache configuration directives, corrupting \nhttpd.conf and preventing Apache from starting after a server reboot, \nresulting in a denial-of-service (DoS) condition affecting the web \nserver and its hosted virtual hosts.","summary":"In koozali SME Server 11.0rc1-215, the domain creation function lets a high-privileged user inject reserved Apache directives into httpd.conf. After a reboot, Apache fails to start, taking down the web server and its virtual hosts.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","infrastructure","self-hosted","sme-server"],"not_affected_if":["auth-required"],"how_to_check":"- Confirm the installed build with `cat /etc/e-smith-release` (unknown if the sources name a different check)\n- Look for unexpected directives in `/etc/httpd/conf/httpd.conf` and run `httpd -t` to see whether the config parses","fix":null,"status":"open","published_at":"2026-10-19T06:17:22+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:40:54+00:00","updated_at":"2026-10-25T03:40:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:40:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SME Server: domain creation lets admins corrupt Apache config, blocking web startup","impact":"medium","summary":"In koozali SME Server 11.0rc1-215, the domain creation function lets a high-privileged user inject reserved Apache directives into httpd.conf. After a reboot, Apache fails to start, taking down the web server and its virtual hosts.","category":"infrastructure","nicknames":[],"who_cares":["sme-server","self-hosted","apache"],"confidence":0.6,"needs_auth":"yes","worst_case":"Apache fails to start after reboot, taking down all hosted virtual hosts","analyst_note":"Find the vendor advisory or fixed SME Server release and the exact check for injected directives; the NVD entry alone gives no fix.","how_to_check":"- Confirm the installed build with `cat /etc/e-smith-release` (unknown if the sources name a different check)\n- Look for unexpected directives in `/etc/httpd/conf/httpd.conf` and run `httpd -t` to see whether the config parses","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"SME Server 11.0rc1-215 installations where administrators can create domains. Exposure needs a high-privileged account, so sites that restrict admin accounts to trusted staff face lower risk. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3379,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108121':15A,18A '-2026':14A,17A '-215':33B,88C '11.0':31B,86C 'admin':6A 'affect':121C 'allow':89C 'apach':8A,19B,46B,53B,98C,105C 'attack':91C 'block':10A 'brian':66C 'condit':120C 'config':9A 'configur':99C 'corrupt':7A,101C 'creation':4A,36B,78C 'cve':13A,16A 'denial':116C 'denial-of-servic':115C 'digitalcanion':69C 'direct':47B,100C 'discov':72C 'domain':3A,35B,77C 'dos':119C 'fail':54B 'function':37B,79C 'high':41B,93C 'high-privileg':40B 'host':23B,65B,127C,129C 'httpd.conf':49B,102C 'infrastructur':20B 'inject':44B,96C 'koozali':28B,81C 'let':5A,38B 'mariani':67C 'prevent':104C 'privileg':42B,94C 'rc1':32B,87C 'reboot':52B,111C 'reserv':45B,97C 'result':112C 'sa':70C 'self':22B 'self-host':21B 'server':2A,26B,30B,61B,84C,110C,124C 'servic':118C 'sme':1A,25B,29B,83C 'sme-serv':24B 'start':56B,107C 'startup':12A 'take':57B 'user':43B 'version':85C 'virtual':64B,128C 'vulner':74C 'web':11A,60B,123C","nicknames":[],"mitigations":[],"who_affected":"SME Server 11.0rc1-215 installations where administrators can create domains. Exposure needs a high-privileged account, so sites that restrict admin accounts to trusted staff face lower risk. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:M/U:Amber","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108121","severity":null,"published_at":"2026-10-19T06:17:22+00:00","modified_at":"2026-10-19T21:03:42+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}