Incorrect authorization in Froxlor - #VU162728
Published: November 9, 2026
Vulnerability identifier: #VU162728
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to steal other accounts' API credentials and gain super administrator control.
The vulnerability exists due to missing owner scoping in Froxlor's api_keys.php listing when customers_see_all and api_allowed are enabled, exposing complete API keys and secrets across administrators and customers. An administrator can open the listing and replay a disclosed super administrator key and secret to authenticate with privileges their own account lacks.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.15