CVE-2026-108121: CWE-20 Improper input validation in Koozali SME Server

The vulnerability CVE-2026-108121 in Koozali SME Server 11.0rc1-215 arises from improper input validation (CWE-20) in the domain creation feature. An attacker with high privileges can inject reserved Apache directives, corrupting the Apache configuration file (httpd.conf). This corruption leads to Apache failing to start after a server reboot, resulting in a denial-of-service condition impacting the web server and all virtual hosts it serves. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, required privileges at high level, and partial impact on availability and integrity.

Successful exploitation results in denial of service by preventing Apache from starting after reboot, disrupting web services hosted on the affected SME Server. The attacker must have high privileges to perform the injection, limiting the scope to privileged users. There is no indication of remote code execution or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor vendor communications for updates. Until a fix is available, restrict high privilege access and validate inputs in domain creation workflows if possible.