Froxlor up to 2.3.13 Email Template Editor admin_templates.php mailbodyid authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in Froxlor up to 2.3.13. Impacted is an unknown function of the file admin_templates.php of the component Email Template Editor. Executing a manipulation of the argument mailbodyid can lead to authorization. The identification of this vulnerability is CVE-2026-109963. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Froxlor up to 2.3.13. This vulnerability affects some unknown functionality of the file admin_templates.php of the component Email Template Editor. The manipulation of the argument mailbodyid with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality. CVE summarizes:

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-109963 since 10/13/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:admin_templates.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.3.14 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.3.13

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion