Froxlor up to 2.3.14 API Key api_keys.php information disclosure

Summaryinfo

A vulnerability was found in Froxlor. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file api_keys.php of the component API Key. Performing a manipulation results in information disclosure. This vulnerability was named CVE-2026-121436. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Froxlor. This affects an unknown function of the file api_keys.php of the component API Key. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-121436 since 11/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

By approaching the search of inurl:api_keys.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.3.15 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Froxlor

Version

• 0.9.33.2
• 0.9.35
• 0.10.14
• 0.10.38
• 0.10.38.2
• 0.10.39
• 2.0.0
• 2.0.0-beta1
• 2.0.8
• 2.0.10
• 2.0.11
• 2.0.13
• 2.0.14
• 2.0.16
• 2.0.20
• 2.0.21
• 2.0.22
• 2.1.0
• 2.1.0-dev1
• 2.1.2
• 2.1.9
• 2.2.0
• 2.2.5
• 2.2.6
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.12
• 2.3.13
• 2.3.14

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion