Missing Authorization in Froxlor - #VU162733
Published: November 9, 2026
Vulnerability identifier: #VU162733
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged customer to retrieve their own traffic statistics in Froxlor despite an administrator restricting access to the traffic feature.
The vulnerability exists due to missing authorization enforcement in the Traffic listing API when traffic is configured in panel.customer_hide_options. A low-privileged customer can authenticate to the enabled API with a valid API key and secret and invoke Traffic.listing to obtain traffic volumes hidden by that restriction.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.16