In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys…
Affects FreedomBox systems with non-administrator user accounts in versions before 26.15, including all currently supported versions. Fixed in 26.15.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 26.15
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects systems with non-administrator user accounts; all currently supported versions are affected (26.14 in stable-backports/testing/unstable, 25.9.3+deb13u1 in stable, 23.6.2+deb12u1 in oldstable).
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 24/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In FreedomBox, a personal server software package, an unprivileged local user account can read and write files it has no permission to access by making the authorized_keys file a symlink. The attacker must already have a local account on the system, and no user interaction is needed.
Read the original description
In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.
cve.now Index
- Exploitation0/40No signal
- Exposure5/25Specific setups only
- Reach10/20Shipped in major Linux distributions
- Severity9.4/10CVSS 8.4, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 74 if added to CISA KEV
- Would score about 69 if CISA's SSVC rates exploitation active
- Would score about 34 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects systems with non-administrator user accounts; all currently supported versions are affected (26.14 in stable-backports/testing/unstable, 25.9.3+deb13u1 in stable, 23.6.2+deb12u1 in oldstable).Upgrade to a fixed version: 26.15.
Workaround: In System -> Secure Shell Server, disable the option "Allow all users to login remotely", so only users in the admin or freedombox-ssh groups (or sudo group) can connect through SSH.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Debian FreedomBox
fixed in 26.15
Evidence 3
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123962
Is CVE-2026-123962 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Unprivileged user accounts can read and write files they are not permitted to access by setting the authorized_keys file to be a symlink.Source: alioth-lists.debian.net, salsa.debian.org
Which versions are affected by CVE-2026-123962?
FreedomBox: before 26.15.Source: cve.now feed data
Am I affected, and how do I check?
All versions before 26.15 are affected, including 26.14, 25.9.3+deb13u1 in stable and 23.6.2+deb12u1 in oldstable. Only systems with non-administrator user accounts are affected, so check the installed freedombox version and whether such accounts exist on the system.Source: alioth-lists.debian.net, salsa.debian.org
How do I fix CVE-2026-123962?
Upgrade to FreedomBox 26.15 or later. Until the upgrade is applied, disable "Allow all users to login remotely" under System -> Secure Shell Server.Source: alioth-lists.debian.net, salsa.debian.org