Recommended action window: Monitor and triage in normal cycle
NVD description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 HIGH: CVE-2026-111650 (CVSS 8.6) - ChronoFrame ≤1.0.0 missing authentication flaw allows unauthenticated attackers to reconfigure instances & redirect storage to attacker-controlled S3/OpenList providers. Patch immediately. #CVE #PatchNow https://t.co/bRsTJrAiTL