CVE-2026-41233: Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()
Froxlor is open source server administration software. Prior to version 2.3.6, in Domains.add(), the adminid parameter is accepted from user input and used without validation when the calling reseller does not have the customersseeall permission. This allows a reseller to attribute newly created domains to any other admin, bypassing their own domain quota (since the wrong admin's domainsused counter is incremented) and potentially exhausting another admin's quota. Version 2.3.6 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41233?
The severity of CVE-2026-41233 is classified as a medium risk due to the potential for Reseller Domain Quota Bypass.
How do I fix CVE-2026-41233?
To fix CVE-2026-41233, update Froxlor to version 2.3.6 or later.
What systems are affected by CVE-2026-41233?
CVE-2026-41233 affects all versions of Froxlor prior to 2.3.6.
What type of vulnerability is CVE-2026-41233?
CVE-2026-41233 is a security vulnerability related to improper input validation in the Domains.add() function.
Who should be concerned about CVE-2026-41233?
Administrators using Froxlor versions before 2.3.6 should be concerned about CVE-2026-41233.