SB2026110972 - Multiple vulnerabilities in Froxlor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110972

SB2026110972 - Multiple vulnerabilities in Froxlor

Published: November 9, 2026

Security Bulletin ID SB2026110972
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated customer to replace the Let's Encrypt-managed certificate and private key for their own domain in Froxlor.

The vulnerability exists due to missing authorization checks in the Certificates.add and Certificates.update API methods when writing certificates for Let's Encrypt-managed domains. A remote authenticated customer can submit an attacker-chosen key pair using their customer API credentials when the API is enabled, causing its deployment and disrupting HTTPS for domain visitors.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated customer to create MySQL databases in Froxlor despite an administrator explicitly disabling the MySQL feature for customers.

The vulnerability exists due to a missing authorization check for panel.customer_hide_options in the Mysqls.add API endpoint when MySQL access is disabled. An authenticated customer can call this endpoint directly to create unauthorized databases within their own quota.


3) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged reseller to read other administrators' contact details and account configuration, including the super-administrator's.

The vulnerability exists due to inconsistent identifier validation in Froxlor's Admins.get API command, which accepts the caller's login name for authorization while selecting another administrator's record by numeric identifier. A low-privileged reseller can submit their login name and a known or guessed administrator identifier using their own API credentials to retrieve that administrator's noncredential record.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated customer to delete a reseller-assigned main domain belonging to their own account in Froxlor.

The vulnerability exists due to missing authorization in the SubDomains.delete API command, which does not check parentdomainid to distinguish main domains from deletable subdomains. An authenticated customer can submit the assigned main domain's identifier using their own API credentials and remove the domain despite the interface prohibiting deletion.


5) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local low-privileged attacker to take ownership of arbitrary host directories, exposing TLS private keys and enabling Apache configuration changes.

The vulnerability exists due to missing symlink containment in Froxlor's root traffic cron when recursively changing ownership of customer statistics directories. A local low-privileged attacker with a domain and document-root write access can replace goaccess with a symlink to obtain ownership of its target when the default-enabled cron runs.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an administrator to steal other accounts' API credentials and gain super administrator control.

The vulnerability exists due to missing owner scoping in Froxlor's api_keys.php listing when customers_see_all and api_allowed are enabled, exposing complete API keys and secrets across administrators and customers. An administrator can open the listing and replay a disclosed super administrator key and secret to authenticate with privileges their own account lacks.


Remediation

Install update from vendor's website.

References