Description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Published: 2026-10-16
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Unauthorized configuration modification
Action: Immediate Patch
AI Analysis

Impact

A missing authentication flaw in ChronoFrame's wizard API allows attackers without credentials to POST to /api/wizard/storage and change the instance's storage provider and site settings. This grants the attacker the ability to redirect uploads, read stored data from a malicious bucket, and overwrite configured site and map parameters, effectively compromising the integrity of the application. The weakness corresponds to CWE-306, a missing authentication flaw that can lead to full control over instance configuration.

Affected Systems

The flaw affects the HoshinoSuzumi ChronoFrame application up to and including version 1.0.0. Any installation exposing the wizard API endpoint is vulnerable if it has not been updated.

Risk and Exploitability

The CVSS score of 8.8 reflects the high impact of remote configuration takeover. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable by any unauthenticated user able to reach the /api/wizard/storage endpoint, so the attack vector is network-based HTTP requests. Because authentication checks are absent, the attacker can modify critical application settings without detection, emphasizing the need for prompt remediation.

Generated by OpenCVE AI on October 16, 2026 at 18:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ChronoFrame to the latest available release that addresses the missing authentication issue.
  • If an upgrade is not immediately possible, restrict access to the wizard API by configuring firewall rules or network segmentation to allow connections only from trusted internal hosts.
  • Apply configuration hardening by enabling authentication and authorization checks on the wizard API endpoints, or temporarily disable the wizard interface if it is not required for production environments.

Generated by OpenCVE AI on October 16, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Title ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T17:39:17.995Z

Reserved: 2026-10-16T14:31:14.856Z

Link: CVE-2026-111650

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:46.047

Modified: 2026-10-16T19:03:18.127

Link: CVE-2026-111650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:45:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function