CVE-2026-123962: Security vulnerability

Published Nov 6, 2026

Updated

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorizedkeys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.

Event History

Nov 6, 2026

CVE Published

via MITRE·05:11 PM

Data Sourced

via MITRE·05:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

FreedomBox versions before 26.15 are affected. Because FreedomBox distributes its software through Debian repositories, administrators should verify the FreedomBox package version supplied by their configured Debian repositories.

What does an attacker need to exploit this issue?

An attacker needs an unprivileged FreedomBox user account and must be able to set that account's authorized_keys file to a symbolic link. This can allow reading and writing files that the account would not ordinarily have permission to access.

How can I tell whether my system is vulnerable?

Check whether the installed FreedomBox version is earlier than 26.15. On affected versions, investigate whether unprivileged accounts can create or replace authorized_keys with symbolic links, and review for authorized_keys files that are symlinks.

CVE-2026-123962: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I tell whether my system is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I tell whether my system is vulnerable?