CVE-2026-109963: Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admintemplates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated reseller administrator can exploit it. The attacker needs access to the email template editor and can use their own subject ID with sequential mail body IDs belonging to other administrators.
What data can be exposed?
The issue allows reading email templates owned by other administrators, including the full administrator's templates. The affected data is the email template body retrieved through the mailbodyid parameter.
Are unauthenticated or ordinary external attackers affected?
The provided information describes exploitation by authenticated reseller administrators. It does not indicate that unauthenticated attackers can exploit the issue.
Which versions should be remediated?
Froxlor versions before 2.3.14 are affected. Upgrade to 2.3.14 or later.