{"id":"CVE-2026-111650","kind":"vulnerability","aliases":["CVE-2026-111650"],"related":[],"title":"ChronoFrame: unauthenticated wizard endpoints let attackers redirect storage and settings","description":"ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.","summary":"ChronoFrame (self-hosted Nuxt photo gallery) <= 1.0.0 protects its setup wizard only with a client-side route middleware. The server handlers under server/api/wizard/ (storage, map, site, complete, submit, admin) have no session, isAdmin or firstLaunch check. Anyone who can reach the instance can POST /api/wizard/storage to add and activate an attacker-controlled S3 or OpenList provider (the storage manager switches live, so uploads and reads go to the attacker), overwrite the public map token and style, deface site settings, or flip the setup flag. If the instance is reachable before onboarding finishes, the attacker can register as first admin. Already-configured instances return 'User already exists' for that last step. Fixed in v1.0.2.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chronoframe","fixed":["1.0.2"],"affected":"<= 1.0.0","ecosystem":"github"}],"ecosystems":[],"tags":["chronoframe","nuxt","openlist","package","photo-gallery","s3","self-hosted"],"not_affected_if":["auth-required","managed-hosting","version-1.0.2-or-later","wizard-routes-blocked-at-proxy"],"how_to_check":"Check the running version: anything <= 1.0.0 (including 1.0.0-rc/beta tags) is affected. Look at the Docker image tag or package.json. v1.0.1 is not confirmed fixed; the fix is announced in v1.0.2. Probe from outside with an unauthenticated POST to /api/wizard/complete on a test copy, or review /api/system/settings/all. Check the Settings > Storage page for an unexpected provider, and check the map token, site title and avatar for unexpected changes. Review the settings_storage_providers table for rows you did not add.","fix":"Upgrade to ChronoFrame v1.0.2 (https://github.com/HoshinoSuzumi/chronoframe/releases/tag/v1.0.2). If you were exposed, then in the admin settings, re-select your own storage provider and delete unknown providers. Check the map token, site identity and uploaded files for tampering. Rotate the S3 or OpenList credentials if you doubt the config. Until you upgrade, block /api/wizard/* at your reverse proxy.","status":"open","published_at":"2026-10-16T18:17:46+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:33:21+00:00","updated_at":"2026-10-24T00:25:57+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ChronoFrame: unauthenticated wizard endpoints let attackers redirect storage and settings","impact":"high","summary":"ChronoFrame through 1.0.0 has setup wizard handlers under server/api/wizard/ that do not require authentication, even on instances already configured. An unauthenticated attacker can POST to /api/wizard/storage to point uploads and reads at an attacker-controlled S3 or OpenList provider and overwrite site and map settings.","category":"package","who_cares":["chronoframe","self-hosted","s3","openlist"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker redirects uploads and storage reads to their own server","analyst_note":"Check the ChronoFrame project for a fixed release after 1.0.0 and whether the wizard routes are reachable on configured instances in default config.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2946,"output_tokens":385,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the ChronoFrame project for a fixed release after 1.0.0 and whether the wizard routes are reachable on configured instances in default config.","search":"'-111650':13A,16A '-2026':12A,15A '/api/wizard/storage':75B,171C '1.0.0':36B,148C 'activ':79B,173C 'add':77B 'admin':59B,130B 'allow':159C 'alreadi':132B,137B,164C 'already-configur':131B 'anyon':67B 'attack':6A,82B,100B,125B,161C,167C,176C 'attacker-control':81B,175C 'authent':152C 'check':66B 'chronofram':1A,18B,29B,146C 'chronoframe':17A 'client':45B 'client-sid':44B 'complet':57B 'configur':133B,165C 'contain':149C 'control':83B,177C 'cve':11A,14A 'defac':108B 'endpoint':4A 'exist':138B 'finish':123B 'first':129B 'firstlaunch':65B 'fix':143B 'flag':115B 'flip':112B 'galleri':24B,35B 'go':97B 'handler':51B,157C 'host':28B,32B 'instanc':72B,118B,134B,166C 'isadmin':63B 'last':141B 'let':5A 'live':92B 'manag':90B 'map':55B,104B,191C 'middlewar':48B 'miss':151C 'nuxt':19B,33B 'onboard':122B 'openlist':20B,86B,180C 'overwrit':101B,188C 'packag':21B 'photo':23B,34B 'photo-galleri':22B 'post':74B,169C 'protect':37B 'provid':87B,181C 'public':103B 'reach':70B 'reachabl':120B 'read':96B,186C 'reconfigur':163C 'redirect':7A,182C 'regist':127B 'return':135B 'rout':47B 's3':25B,84B,178C 'self':27B,31B 'self-host':26B,30B 'server':50B 'server/api/wizard':53B,156C 'session':62B 'set':10A,110B,192C 'setup':39B,114B 'side':46B 'site':56B,109B,189C 'step':142B 'storag':8A,54B,89B,185C 'style':107B 'submit':58B 'switch':91B 'token':105B 'unauthent':2A,160C 'upload':94B,183C 'user':136B 'v1.0.2':145B 'vulner':153C 'wizard':3A,40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111650","severity":null,"published_at":"2026-10-16T18:17:46+00:00","modified_at":"2026-10-19T14:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111650:658","url":null,"severity":null,"published_at":"2026-10-24T00:25:57+00:00","modified_at":"2026-10-24T00:25:57+00:00","first_seen_at":"2026-10-24T00:25:57+00:00","fetched_at":"2026-10-24T00:25:57+00:00","note":"Read finder writeup (hackmd), v1.0.0 handler source, VulnCheck/CVE record; fix = v1.0.2 (release notes 'security fixes for the setup wizard', commit 893f587 'block setup endpoints after initialization'; I did not read the diff). No exploitation reports; writeup is static review only, no PoC run. X count ~1 post, skipped."}],"documents":[{"id":2605,"url":"https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover","title":"ChronoFrame unauthenticated setup-wizard API (hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2606,"url":"https://github.com/HoshinoSuzumi/chronoframe/releases/tag/v1.0.2","title":"ChronoFrame v1.0.2: security fixes for the setup wizard","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2607,"url":"https://github.com/HoshinoSuzumi/chronoframe/commit/893f587","title":"fix(wizard): block setup endpoints after initialization","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2608,"url":"https://www.vulncheck.com/advisories/chronoframe-through-1.0.0-missing-authentication-via-setup-wizard-api","title":"VulnCheck: ChronoFrame through 1.0.0 missing auth via setup wizard API","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}