# FreedomBox Security Issue

**URL:** <https://discuss.freedombox.org/t/freedombox-security-issue/4412>\
**Category:** Announcements\
**Created:** [November 1, 2026, 8:15pm UTC](https://discuss.freedombox.org/t/freedombox-security-issue/4412 "2026-11-01T20:15:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jvalleroy](https://discuss.freedombox.org/user_avatar/discuss.freedombox.org/jvalleroy/32/331_2.png) [@jvalleroy](https://discuss.freedombox.org/u/jvalleroy)\
**Post date:** [November 1, 2026, 8:15pm UTC](https://discuss.freedombox.org/t/freedombox-security-issue/4412/1 "2026-11-01T20:15:22Z")

</div>

A security issue has been discovered in FreedomBox. Any FreedomBox system that has non-administrator users on it is affected.

All currently supported versions are affected:

- 26.14 in stable-backports/testing/unstable
- 25.9.3+deb13u1 in stable
- 23.6.2+deb12u1 in oldstable

A fix is being prepared at this time. In the mean time, if you have non-administrator users, here is a mitigation action that you can take:

In System → Secure Shell Server, disable the option “Allow all users to login remotely”. Then, only users in the “admin” or “freedombox-ssh” groups (or system “sudo” group) will be able to connect through SSH.

---

<div class="post-metadata">

**Author:** ![joseph](https://discuss.freedombox.org/letter_avatar_proxy/v4/letter/j/dc4da7/32.png) [@joseph](https://discuss.freedombox.org/u/joseph)\
**Post date:** [November 2, 2026, 12:46am UTC](https://discuss.freedombox.org/t/freedombox-security-issue/4412/2 "2026-11-02T00:46:47Z")

</div>

Thanks for sharing that. Here’s a screen shot of the configuration page in [https://myfreedombox/freedombox/sys/ssh](https://myfreedombox/freedombox/sys/ssh)

 ![image](https://discuss.freedombox.org/uploads/default/original/2X/0/0c73f80923e2f65027a2ecc77d17f40c3e496d42.png)