---
id: "CVE-2026-111650"
kind: "vulnerability"
aliases: ["CVE-2026-111650"]
title: "ChronoFrame: unauthenticated wizard endpoints let attackers redirect storage and settings"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "chronoframe", "fixed": ["1.0.2"], "affected": "<= 1.0.0", "ecosystem": "github"}]
ecosystems: []
tags: ["chronoframe", "nuxt", "openlist", "package", "photo-gallery", "s3", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting", "version-1.0.2-or-later", "wizard-routes-blocked-at-proxy"]
published_at: "2026-10-16T18:17:46+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:25:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111650", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:25:57+00:00"}]
---

# ChronoFrame: unauthenticated wizard endpoints let attackers redirect storage and settings

ChronoFrame (self-hosted Nuxt photo gallery) <= 1.0.0 protects its setup wizard only with a client-side route middleware. The server handlers under server/api/wizard/ (storage, map, site, complete, submit, admin) have no session, isAdmin or firstLaunch check. Anyone who can reach the instance can POST /api/wizard/storage to add and activate an attacker-controlled S3 or OpenList provider (the storage manager switches live, so uploads and reads go to the attacker), overwrite the public map token and style, deface site settings, or flip the setup flag. If the instance is reachable before onboarding finishes, the attacker can register as first admin. Already-configured instances return 'User already exists' for that last step. Fixed in v1.0.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:chronoframe affected <= 1.0.0 fixed 1.0.2

## How to check

Check the running version: anything <= 1.0.0 (including 1.0.0-rc/beta tags) is affected. Look at the Docker image tag or package.json. v1.0.1 is not confirmed fixed; the fix is announced in v1.0.2. Probe from outside with an unauthenticated POST to /api/wizard/complete on a test copy, or review /api/system/settings/all. Check the Settings > Storage page for an unexpected provider, and check the map token, site title and avatar for unexpected changes. Review the settings_storage_providers table for rows you did not add.

## Fix

Upgrade to ChronoFrame v1.0.2 (https://github.com/HoshinoSuzumi/chronoframe/releases/tag/v1.0.2). If you were exposed, then in the admin settings, re-select your own storage provider and delete unknown providers. Check the map token, site identity and uploaded files for tampering. Rotate the S3 or OpenList credentials if you doubt the config. Until you upgrade, block /api/wizard/* at your reverse proxy.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111650
- 2026-10-24T00:25:57+00:00 analyst — Read finder writeup (hackmd), v1.0.0 handler source, VulnCheck/CVE record; fix = v1.0.2 (release notes 'security fixes for the setup wizard', commit 893f587 'block setup endpoints after initialization'; I did not read the diff). No exploitation reports; writeup is static review only, no PoC run. X count ~1 post, skipped.

## Documents

- [advisory] ChronoFrame unauthenticated setup-wizard API (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover
- [advisory] VulnCheck: ChronoFrame through 1.0.0 missing auth via setup wizard API https://www.vulncheck.com/advisories/chronoframe-through-1.0.0-missing-authentication-via-setup-wizard-api
- [fix] ChronoFrame v1.0.2: security fixes for the setup wizard https://github.com/HoshinoSuzumi/chronoframe/releases/tag/v1.0.2
- [fix] fix(wizard): block setup endpoints after initialization https://github.com/HoshinoSuzumi/chronoframe/commit/893f587

## From the sources

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_