CVE-2026-123962

Summary

In FreedomBox before 26.15, unprivileged users can bypass file permission restrictions by creating a symlink to an authorized_keys file, enabling them to read or write arbitrary files they should not access. This is a classic TOCTOU (Time-of-Check to Time-of-Use) vulnerability in SSH key handling that allows privilege escalation.

Exploitability

Exploitation requires local access as an unprivileged user and knowledge of the target system's authorized_keys file location; no remote exploitation or special tools are needed.

Blast radius

Successful exploitation grants full read/write access to files normally restricted, potentially leading to full system compromise via credential theft, backdoor installation, or privilege escalation to root.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade FreedomBox to version 26.15 or later, which patches the symlink vulnerability in authorized_keys handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.