Live › vulnerability › CVE-2026-111650
Go to dashboardChronoFrame (self-hosted Nuxt photo gallery) <= 1.0.0 protects its setup wizard only with a client-side route middleware. The server handlers under server/api/wizard/ (storage, map, site, complete, submit, admin) have no session, isAdmin or firstLaunch check. Anyone who can reach the instance can POST /api/wizard/storage to add and activate an attacker-controlled S3 or OpenList provider (the storage manager switches live, so uploads and reads go to the attacker), overwrite the public map token and style, deface site settings, or flip the setup flag. If the instance is reachable before onboarding finishes, the attacker can register as first admin. Already-configured instances return 'User already exists' for that last step. Fixed in v1.0.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| chronoframe | github | <= 1.0.0 | 1.0.2 |
1.0.0 (including 1.0.0-rc/beta tags) is affectedv1.0.1 is not confirmed fixed; the fix is announced in v1.0.2v1.0.2 (https://github.com/HoshinoSuzumi/chronoframe/releases/tag/v1.0.2)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-111650")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.