Symlink Misconfiguration in FreedomBox by FreedomBox Team

CVE-2026-123962

What is CVE-2026-123962?

In versions prior to 26.15 of FreedomBox, a vulnerability exists that allows unprivileged user accounts to bypass file permissions by manipulating the authorized_keys file to create a symbolic link (symlink). This misconfiguration can lead to unauthorized read and write access to files that should otherwise be protected. FreedomBox is built as a Debian Pure Blend, hence it functions using packages from Debian repositories, making it essential for users to update to the latest version to mitigate this risk.

References