Description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Published: 2026-10-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized configuration modification
Action: Immediate Patch
AI Analysis

Impact

A missing authentication flaw in ChronoFrame's wizard API allows attackers without credentials to POST to /api/wizard/storage and change the instance's storage provider and site settings. This grants the attacker the ability to redirect uploads, read stored data from a malicious bucket, and overwrite configured site and map parameters, effectively compromising the integrity of the application. The weakness corresponds to CWE-306, a missing authentication flaw that can lead to full control over instance configuration.

Affected Systems

The flaw affects the HoshinoSuzumi ChronoFrame application up to and including version 1.0.0. Any installation exposing the wizard API endpoint is vulnerable if it has not been updated.

Risk and Exploitability

The CVSS score of 8.8 reflects the high impact of remote configuration takeover. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable by any unauthenticated user able to reach the /api/wizard/storage endpoint, so the attack vector is network-based HTTP requests. Because authentication checks are absent, the attacker can modify critical application settings without detection, emphasizing the need for prompt remediation.

Generated by OpenCVE AI on October 16, 2026 at 18:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ChronoFrame to the latest available release that addresses the missing authentication issue.
  • If an upgrade is not immediately possible, restrict access to the wizard API by configuring firewall rules or network segmentation to allow connections only from trusted internal hosts.
  • Apply configuration hardening by enabling authentication and authorization checks on the wizard API endpoints, or temporarily disable the wizard interface if it is not required for production environments.

Generated by OpenCVE AI on October 16, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Hoshinosuzumi
Hoshinosuzumi chronoframe
Vendors & Products Hoshinosuzumi
Hoshinosuzumi chronoframe

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Title ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Hoshinosuzumi Chronoframe
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T13:19:39.585Z

Reserved: 2026-10-16T14:31:14.856Z

Link: CVE-2026-111650

cve-icon Vulnrichment

Updated: 2026-10-19T13:18:30.991Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:46.047

Modified: 2026-10-19T14:16:58.573

Link: CVE-2026-111650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:27:40Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function