Missing Authorization in Froxlor - #VU162723
Published: November 9, 2026
Vulnerability identifier: #VU162723
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated customer to replace the Let's Encrypt-managed certificate and private key for their own domain in Froxlor.
The vulnerability exists due to missing authorization checks in the Certificates.add and Certificates.update API methods when writing certificates for Let's Encrypt-managed domains. A remote authenticated customer can submit an attacker-chosen key pair using their customer API credentials when the API is enabled, causing its deployment and disrupting HTTPS for domain visitors.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.15