{"id":"CVE-2026-123962","published":"2026-11-06T17:17:25.483","lastModified":"2026-11-06T22:17:51.267","description":"In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-61"],"vendors":[],"products":[],"references":[{"url":"https://alioth-lists.debian.net/pipermail/freedombox-discuss/2026-November/010041.html","tags":[]},{"url":"https://freedombox.org/about/","tags":[]},{"url":"https://salsa.debian.org/freedombox-team/freedombox/-/commit/351b6a5c9b432f29ecab2a74d5426977bca29188","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In FreedomBox before 26.15, unprivileged users can bypass file permission restrictions by creating a symlink to an authorized_keys file, enabling them to read or write arbitrary files they should not access. This is a classic TOCTOU (Time-of-Check to Time-of-Use) vulnerability in SSH key handling that allows privilege escalation.","exploitability":"Exploitation requires local access as an unprivileged user and knowledge of the target system's authorized_keys file location; no remote exploitation or special tools are needed.","blast_radius":"Successful exploitation grants full read/write access to files normally restricted, potentially leading to full system compromise via credential theft, backdoor installation, or privilege escalation to root.","remediation":"Upgrade FreedomBox to version 26.15 or later, which patches the symlink vulnerability in authorized_keys handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","symlink-attack","ssh","local-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:50:22.566Z"}}