CVE-2026-111650 is a high severity (CVSS 8.6) missing authentication flaw in ChronoFrame through 1.0.0. The setup wizard API still accepts changes after the site is configured, so an unauthenticated caller can swap the storage provider. The record names no fixed version.
What's affected
ChronoFrame 1.0.0 and earlier, per the record and VulnCheck. The wizard handlers under the wizard API path do not require authentication, even on instances that finished setup. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record says an attacker can activate an attacker-controlled S3 or OpenList storage provider, which redirects uploads and storage reads, and can overwrite site and map settings.
Scoring note: the record's 8.6 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.8 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm your ChronoFrame version. Then review the storage configuration in the admin interface and compare the bucket name, endpoint and credentials against what you set. Anything you do not recognise is a sign of tampering.
In your proxy logs, look for POST requests to the wizard API paths after your initial setup date. A configured site should see none.
What to do now
- Find every ChronoFrame instance and version.
- Block the wizard API path at your reverse proxy once setup is complete.
- Check storage and site settings and restore known good values.
- Review recent uploads in case they went to a storage provider you do not control.
- Rotate storage credentials if you find changes.
- Upgrade when a fixed release is published and confirmed.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-306, missing authentication for a critical function. A setup wizard is meant to run once, but the handlers never check whether setup has finished or who is calling. Setup logic is powerful by design, so leaving it reachable hands over the configuration of the whole app.
Redirecting storage is a quiet attack. Visitors still see a working site while photos land in someone else's bucket. It is not listed in CISA KEV.
Quick check
Why does a finished setup matter?
A configured instance should refuse wizard calls. The record says ChronoFrame does not, so finished sites are exposed.
Can I block the wizard path myself?
Yes, at a reverse proxy, as a stopgap. It is not a substitute for a fixed release.
Sources
Last reviewed: 18 October 2026.
