Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck
CVE-2026-113676Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
Medium 4.3
In plain English
A medium-severity incorrect authorization in froxlor from froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-m7gc-8c8g-4f89) vendor-advisory
- https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a patch
- froxlor 2.3.15 Release Notes release-notes
- https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444 technical-description
- VulnCheck Advisory: Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API third-party-advisory