Skip to content
OpenAdvisories
High WID-SEC-2026-4050 6 CVEs

Froxlor: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Nov 3, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Froxlor ausnutzen, um Administratorrechte zu erlangen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Product

Froxlor ist eine Web-basierte Server-Management-Software.

Vulnerabilities 6

  • Critical 9.9
    CVE-2026-113678

    Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

    Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess …

    froxlor froxlor
  • High 7.2
    CVE-2026-121436

    Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

    Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super admi…

    froxlor froxlor
  • Medium 5.4
    CVE-2026-113677

    Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API

    Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web U…

    froxlor froxlor
  • Medium 5.4
    CVE-2026-121434

    Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

    Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed c…

    froxlor froxlor
  • Medium 4.3
    CVE-2026-113676

    Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

    Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to r…

    froxlor froxlor
  • Medium 4.3
    CVE-2026-121435

    Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

    Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when t…

    froxlor froxlor

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-121434, EUVD-2026-115856, CVE-2026-121436, EUVD-2026-115858, CVE-2026-121435, EUVD-2026-115857

  2. #2

    Referenz(en) aufgenommen: CVE-2026-113677, EUVD-2026-105093, CVE-2026-113678, EUVD-2026-105094, CVE-2026-113676, EUVD-2026-105092

  3. #1

    Initiale Fassung

References