CVE-2026-111650: ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

Q: Which deployments are exposed?

ChronoFrame instances through version 1.0.0 are affected if their Setup Wizard API handlers are reachable. The issue can be exploited against instances that have already been configured.

Q: Does exploitation require an account or user interaction?

No. The vulnerability is reachable over the network with low attack complexity and requires neither privileges nor user interaction.

Q: What can an attacker change through the exposed API?

An attacker can POST to /api/wizard/storage to enable an attacker-controlled S3 or OpenList storage provider. This can redirect uploads and storage reads and allow overwriting site and map settings.

Published Oct 16, 2026

Updated

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.

Affected Software

1 affected component

ChronoFrame<=1.0.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

ChronoFrame instances through version 1.0.0 are affected if their Setup Wizard API handlers are reachable. The issue can be exploited against instances that have already been configured.

Does exploitation require an account or user interaction?

No. The vulnerability is reachable over the network with low attack complexity and requires neither privileges nor user interaction.

What can an attacker change through the exposed API?

An attacker can POST to /api/wizard/storage to enable an attacker-controlled S3 or OpenList storage provider. This can redirect uploads and storage reads and allow overwriting site and map settings.

CVE-2026-111650: ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker change through the exposed API?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker change through the exposed API?