Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-109963Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in froxlor from froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.

Affected products (as reported)

Vendor	Product	Versions
froxlor	froxlor	0 – before 2.3.14

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-646m-cj89-hm32) vendor-advisory
VulnCheck Advisory: Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php third-party-advisory