CVE-2025-26342

The maxprofile/accounts/routes.lua file lacks an authentication mechanism for the critical account management function. An attacker can send properly crafted HTTP requests directly to the vulnerable endpoint without needing any credentials. This makes it possible to register a new user with any privilege level, including full administrative rights.

An attacker can gain full control over the Q-Free MaxTime system by creating their own administrator account, leading to complete compromise of system confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. It is recommended to urgently update the Q-Free MaxTime system to a version higher than 2.11.0 and restrict network access to the management interface using a firewall until the patch is implemented.

Q-Free MaxTime version 2.11.0 and earlier