CVE-2026-113677: Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomainsused below zero to gain extra subdomain allowance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Froxlor customer can exploit it. The attacker needs to know or supply the ID of a main domain that was provisioned by a reseller.
Are default web UI restrictions sufficient protection?
No. The issue is specifically an authorization bypass in the SubDomains.delete API command, allowing an authenticated customer to bypass the web UI restriction by submitting a main domain ID directly.
What is the impact beyond deleting a domain?
Deleting the reseller-provisioned main domain can orphan associated vhost, DNS, and subdomain records. It can also reduce subdomains_used below zero, giving the customer additional subdomain allowance.
Which versions need remediation?
Froxlor versions from 0.10.0 through versions before 2.3.15 are affected. Version 2.3.15 is identified as the release containing the fix.