{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/chronoframe--1.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chronoframe:chronoframe:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-111650"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ChronoFrame (\u003c= 1.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ChronoFrame"],"content_html":"\u003cp\u003eChronoFrame through version 1.0.0 contains a critical missing authentication vulnerability within its server/api/wizard/ handlers. This vulnerability allows an unauthenticated, remote attacker to interact with the configuration wizard of an already initialized instance. By sending unauthorized HTTP POST requests to the /api/wizard/storage endpoint, an attacker can modify critical application parameters. Successful exploitation enables the attacker to redirect application data storage to a malicious S3 or OpenList provider, effectively intercepting uploaded data and potentially gaining control over site and map configurations. This flaw poses a high risk to data integrity and confidentiality for deployments of ChronoFrame.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized actors to control the storage backend of ChronoFrame instances. This can result in the full exfiltration or interception of user data being written to redirected storage providers. Additionally, the ability to overwrite site and map settings allows attackers to manipulate the application's behavior and potentially perform further administrative actions. The risk is high for any organization hosting public-facing ChronoFrame instances.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for unauthorized access attempts or suspicious POST requests targeting the /api/wizard/ path.\u003c/li\u003e\n\u003cli\u003eAudit current ChronoFrame instance configurations to ensure storage providers point to expected, legitimate S3 or OpenList endpoints.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the /api/wizard/ endpoint to authorized administrative IP addresses only.\u003c/li\u003e\n\u003cli\u003ePrioritize upgrading ChronoFrame to a version that addresses this missing authentication vulnerability as soon as a security patch is provided by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:49:29Z","date_published":"2026-10-16T18:49:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-chronoframe-auth-bypass/","summary":"ChronoFrame versions 1.0.0 and earlier are vulnerable to a missing authentication flaw in API handlers, allowing unauthenticated attackers to reconfigure instance storage and site settings.","title":"Missing Authentication in ChronoFrame Wizard API","url":"https://feed.craftedsignal.io/briefs/2026-10-chronoframe-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - ChronoFrame (\u003c= 1.0.0)","version":"https://jsonfeed.org/version/1.1"}