Description
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| froxlor | froxlor | 0.10.0 – < 2.3.15 | 2.3.15 |
Advisories 1
- WID-SEC-2026-4050 Froxlor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
References
- GitHub Security Advisory (GHSA-m7gc-8c8g-4f89) vendor-advisory
- https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a patch
- froxlor 2.3.15 Release Notes release-notes
- https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444 technical-description
- VulnCheck Advisory: Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API third-party-advisory