CVE-2026-113676GHSA-m7gc-8c8g-4f89
Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
froxlor froxlor
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.15froxlorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
Text from CVE List
Affected versions 1
- froxloraffected: 0.10.0 before 2.3.15CVE List
References 5
- github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0aFixvia CVE List
- github.com/froxlor/froxlor/releases/tag/2.3.15Fixvia CVE List
- vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-apiAdvisoryvia CVE List
- github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89Exploitvia CVE List
- github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444Referencevia CVE List