CVE-2026-109963 in Froxlor
Summary
by MITRE • 10/13/2026
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as CWE-639, known as Insecure Direct Object Reference (IDOR), exists within Froxlor versions prior to 2.3.14 specifically in the admin_templates.php module responsible for managing email template configurations. This flaw stems from a fundamental failure in server-side access control logic where the application retrieves and processes data based on user-supplied input without verifying that the requesting user has legitimate ownership or authorization rights over that specific resource. In this particular implementation, the mail body content is fetched using an identifier parameter named mailbodyid while completely neglecting to validate whether the currently authenticated administrator's ID matches the owner of the requested template. This architectural oversight allows any authenticated user with reseller privileges to manipulate object references directly and bypass intended security boundaries.
From a technical perspective, the exploitation mechanism relies on the predictable nature of sequential identifiers often used in database primary keys or internal state management systems. An attacker who has successfully authenticated as an admin-level reseller can construct HTTP requests that pair their own valid subjectid with sequentially incremented foreign mailbodyid values. By iterating through these IDs, the application is tricked into returning content associated with different administrative accounts rather than restricting access to only those templates explicitly assigned to the requester. This behavior effectively neutralizes the isolation mechanisms intended between distinct administrator and reseller roles within the Froxlor platform, turning a standard configuration interface into an unauthorized data retrieval vector.
The operational impact of this vulnerability is significant due to the sensitive nature of email template contents in hosting control panels. Email templates often contain dynamic placeholders for customer details such as names, IP addresses, domain names, and sometimes even temporary passwords or authentication tokens used during account provisioning processes. By reading other administrators' email templates, an attacker can gather intelligence about the system's configuration patterns, potentially identifying hardcoded strings that might reveal internal infrastructure details or exposing sensitive data embedded in template bodies intended for specific customer segments. Furthermore, if these templates are reused across multiple accounts with slight variations, analyzing them could aid in crafting more convincing phishing campaigns against end-users managed by the compromised hosting provider.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1530 Data from Local System Extraction if viewed through the lens of lateral movement within a multi-tenant environment where one reseller compromises another's operational data. The lack of proper authorization checks represents a critical gap in identity and access management protocols. To mitigate this risk, developers must implement strict ownership verification logic before processing any request that accesses resource-specific data. This involves querying the database to confirm that the mailbodyid belongs to an entity owned by or explicitly shared with the adminid associated with the current session token. Additionally, implementing randomization for internal identifiers rather than relying on sequential integers can reduce the efficiency of enumeration attacks, although it does not replace the need for proper access control checks. Regular security audits focusing on object reference validation and enforcing principle of least privilege in administrative interfaces are essential steps to prevent similar vulnerabilities in web applications handling sensitive configuration data.