CVE-2026-113676 in Froxlor
Summary
by MITRE • 10/20/2026
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The Froxlor control panel software contains a critical authorization bypass vulnerability within its Admins.get API endpoint, affecting versions from 0.10.0 up to but not including version 2.3.15. This flaw stems from an identifier confusion weakness where the application fails to properly validate that the authenticated user has permission to access the specific administrative record being requested. Instead of strictly binding the data retrieval operation to the identity of the currently logged-in reseller, the system relies on a numeric identifier provided in the request payload without sufficient cross-referencing against the user's assigned privileges or ownership boundaries. This architectural oversight allows an attacker with valid credentials at the reseller level to manipulate API parameters and access sensitive information belonging to higher-privileged administrators.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control, specifically manifesting as an IDOR or Insecure Direct Object Reference issue where the server trusts client-supplied identifiers without verifying authorization context. The attack vector involves sending a crafted API request that includes the attacker's own login name alongside a numeric identifier corresponding to another administrator account. Because the backend logic does not enforce strict ownership checks, it processes the request and returns the full profile data for the targeted admin record. This bypasses standard role-based access control mechanisms designed to isolate reseller accounts from administrative functions and sensitive configuration data.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed information. Attackers can retrieve comprehensive details about administrators, including their contact email addresses, IP allow-lists which define trusted network sources for authentication or API access, resource limits that dictate system capacity allocations, internal notes containing potentially confidential business logic or security configurations, and login history records. The exposure of IP allow-lists is particularly dangerous as it may reveal the infrastructure's trusted networks, aiding in further reconnaissance or targeted attacks against specific administrative interfaces. Additionally, obtaining email addresses facilitates phishing campaigns aimed at compromising higher-privileged accounts, while access to resource limits allows attackers to understand system constraints for potential denial-of-service planning or privilege escalation attempts.
This vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts and specifically relates to the exploitation of misconfigured permissions within identity management systems. It also reflects aspects of T1539 Steal Web Session Cookie if session tokens are involved in the API authentication, although the primary issue is authorization logic rather than credential theft per se. The ability to enumerate administrative contacts and configurations significantly expands the attack surface for subsequent phases such as discovery or lateral movement within the hosting environment managed by Froxlor.
Mitigation strategies should prioritize immediate upgrading of the Froxlor installation to version 2.3.15 or later, where this identifier confusion has been resolved through stricter validation logic. In environments where patching is not immediately feasible, administrators should implement network-level controls such as Web Application Firewalls that inspect API payloads for patterns indicative of IDOR attacks, specifically looking for mismatches between the authenticated user's role and the target resource identifiers. Additionally, enforcing strict IP allow-lists on administrative interfaces can limit exposure to untrusted networks, reducing the likelihood of successful exploitation by external actors. Regular security audits focusing on access control logic in API endpoints are recommended to detect similar flaws before they can be exploited in production environments.