SB2026110973 - Missing Authorization in Froxlor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110973

SB2026110973 - Missing Authorization in Froxlor

Published: November 9, 2026

Security Bulletin ID SB2026110973
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged customer to retrieve their own traffic statistics in Froxlor despite an administrator restricting access to the traffic feature.

The vulnerability exists due to missing authorization enforcement in the Traffic listing API when traffic is configured in panel.customer_hide_options. A low-privileged customer can authenticate to the enabled API with a valid API key and secret and invoke Traffic.listing to obtain traffic volumes hidden by that restriction.


Remediation

Install update from vendor's website.

References