Vulnerability in froxlor

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4050

  Froxlor: Multiple vulnerabilities Translated from German

  CVE-2026-113677CVE-2026-113676CVE-2026-113678

[ References ]References

• github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php
• github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a
• github.com/froxlor/froxlor/releases/tag/2.3.15
• github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89
• www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admi…