CVE-2026-113676: Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A reseller account can exploit it. The attacker must be able to invoke the Admins.get API command and supply their own loginname together with another administrator's numeric ID.
What information could be exposed?
An attacker can retrieve another administrator record, including contact email, IP allow-lists, resource limits, notes, and login history. The provided severity vector indicates confidentiality impact only; no integrity or availability impact is stated.
Which versions are affected and what version fixes it?
Froxlor versions from 0.10.0 before 2.3.15 are affected. Upgrade to version 2.3.15 or later.