{"id":"CVE-2026-123962","kind":"vulnerability","aliases":["CVE-2026-123962"],"related":[],"title":"FreedomBox: unprivileged users can read and write protected files via symlink","description":"In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.","summary":"In FreedomBox before 26.15, an unprivileged user account can make its authorized_keys file a symlink to another file. This lets that account read and write files it has no permission to access.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["debian","freedombox","runtime","self-hosted"],"not_affected_if":["freedombox-26.15-or-later"],"how_to_check":"- Check the installed FreedomBox version, for example with `dpkg -l freedombox`.\n- Look for unexpected symlinks at the `authorized_keys` location in user home directories, for example with `find /home -name authorized_keys -type l`.","fix":"- FreedomBox: move to `26.15` or later.","status":"open","published_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:44:53+00:00","updated_at":"2026-11-06T17:44:53+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T17:44:53Z","model":"claude-haiku-5-5","output":{"fix":"- FreedomBox: move to `26.15` or later.","reach":"local","title":"FreedomBox: unprivileged users can read and write protected files via symlink","impact":"high","summary":"In FreedomBox before 26.15, an unprivileged user account can make its authorized_keys file a symlink to another file. This lets that account read and write files it has no permission to access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freedombox","self-hosted","debian"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads and writes files they lack permission for","analyst_note":"Confirm the affected user-account conditions and the exact fixed release in the NVD entry or the FreedomBox project advisory.","how_to_check":"- Check the installed FreedomBox version, for example with `dpkg -l freedombox`.\n- Look for unexpected symlinks at the `authorized_keys` location in user home directories, for example with `find /home -name authorized_keys -type l`.","plain_action":"","needs_analyst":true,"not_affected_if":["freedombox-26.15-or-later"],"who_is_affected":"FreedomBox installations before 26.15 where unprivileged user accounts exist. The sources do not say whether the flaw needs any non-default setting. Systems running only a single trusted administrator account are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4217,"output_tokens":510,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123962':14A,17A '-2026':13A,16A '26.15':27B,60C 'access':56B 'account':31B,46B,63C 'anoth':41B 'author':35B,75C 'blend':88C 'cve':12A,15A 'debian':18B,86C,97C 'distribut':93C 'file':9A,37B,42B,50B,66C,77C 'freedombox':1A,19B,25B,58C,83C 'host':23B 'key':36B,76C 'lack':70C 'let':44B 'make':33B 'mean':90C 'note':82C 'permiss':54B,71C 'protect':8A 'pure':87C 'read':5A,47B 'read/write':65C 'repositori':98C 'runtim':20B 'self':22B 'self-host':21B 'set':73C 'softwar':95C 'symlink':11A,39B,81C 'unprivileg':2A,29B,61C 'user':3A,30B,62C 'via':10A 'write':7A,49B","nicknames":[],"mitigations":[],"who_affected":"FreedomBox installations before 26.15 where unprivileged user accounts exist. The sources do not say whether the flaw needs any non-default setting. Systems running only a single trusted administrator account are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["debian","freedombox","high","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123962':14A,17A '-2026':13A,16A 'cve':12A,15A 'file':9A 'freedombox':1A 'protect':8A 'read':5A 'symlink':11A 'unprivileg':2A 'user':3A 'via':10A 'write':7A","search_b":"'26.15':27B 'access':56B 'account':31B,46B 'anoth':41B 'author':35B 'debian':18B 'file':37B,42B,50B 'freedombox':19B,25B 'host':23B 'key':36B 'let':44B 'make':33B 'permiss':54B 'read':47B 'runtim':20B 'self':22B 'self-host':21B 'symlink':39B 'unprivileg':29B 'user':30B 'write':49B","search_c":"'26.15':60C 'account':63C 'author':75C 'blend':88C 'debian':86C,97C 'distribut':93C 'file':66C,77C 'freedombox':58C,83C 'key':76C 'lack':70C 'mean':90C 'note':82C 'permiss':71C 'pure':87C 'read/write':65C 'repositori':98C 'set':73C 'softwar':95C 'symlink':81C 'unprivileg':61C 'user':62C","first_public_at":"2026-11-06T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123962","severity":null,"published_at":"2026-11-06T17:17:25+00:00","modified_at":"2026-11-06T17:17:25+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}