CVE-2026-113677 in Froxlor
Summary
by MITRE • 10/20/2026
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Froxlor versions prior to 2.3.15 represents a critical failure in access control mechanisms within the application's API layer. Specifically, this flaw resides in the SubDomains.delete command, which is designed to manage the lifecycle of subdomains for customer accounts. The core technical issue stems from insufficient authorization checks when processing requests that target main domains provisioned by resellers. While the web-based user interface correctly restricts customers from deleting or modifying resources owned by their respective resellers, this security boundary is not enforced in the underlying API logic. Consequently, an authenticated attacker who possesses valid customer credentials can manipulate HTTP request parameters to supply a specific main domain identifier that belongs to another entity within the system hierarchy.
This architectural inconsistency allows for a direct bypass of intended access controls, classified under CWE-269 as Improper Privilege Management or more specifically CWE-862 Missing Authorization. By exploiting this gap, an authenticated user can execute administrative-level actions typically reserved for resellers or super-administrators. The attacker does not need to escalate privileges through credential theft; rather, they leverage their existing low-level access to perform high-impact operations by simply altering the target resource identifier in the API payload. This type of vulnerability is particularly dangerous because it often goes undetected by standard security scanners that focus on authentication failures rather than authorization logic errors within authenticated sessions.
The operational impact of this vulnerability extends beyond simple data deletion, affecting the integrity and availability of hosting infrastructure components managed by Froxlor. When a reseller-provisioned main domain is deleted via this API endpoint, it triggers cascading effects across multiple system services. The associated virtual host configurations are removed from the web server, leading to immediate service disruption for legitimate users hosted on those domains. Furthermore, DNS records linked to these domains may be orphaned or incorrectly modified depending on how the underlying automation scripts handle partial failures. This can result in broken links, email delivery issues, and general instability within the hosting environment managed by the reseller.
A more insidious consequence of this exploit involves the manipulation of resource quotas assigned to customer accounts. The vulnerability allows attackers to drive the subdomains_used counter below zero for their own account or potentially affect accounting metrics for others depending on implementation details. In many billing and provisioning systems, negative counters can be exploited to gain extra subdomain allowances beyond what was paid for or provisioned by the reseller. This constitutes a form of resource abuse that undermines the business logic of the hosting provider, allowing attackers to expand their infrastructure footprint without authorization or payment.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to privilege escalation and lateral movement within cloud environments. Specifically, it reflects behaviors associated with T1078 Valid Accounts, where an attacker uses legitimate credentials to access resources they should not have permission to modify. The ability to delete critical infrastructure components like DNS and web server configurations also touches upon availability-focused attacks similar to T1499 Endpoint Denial of Service or T1529 System Shutdown/Reboot if the deletion leads to service crashes, although in this case it is more accurately described as unauthorized resource modification leading to operational disruption.
To mitigate this vulnerability, immediate action must be taken by upgrading Froxlor to version 2.3.15 or later, where these authorization checks have been corrected. For organizations unable to patch immediately due to compatibility constraints, a temporary mitigation involves implementing strict input validation and access control verification at the reverse proxy or API gateway level. This secondary layer of defense should verify that the authenticated user has explicit permission over the specific resource ID being targeted before allowing the request to reach the application logic. Additionally, auditing logs for unusual patterns in subdomain deletion requests can help detect ongoing exploitation attempts while permanent fixes are deployed.