CVE-2026-113676

Medium

Description

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

SeverityMedium

CVSS4.3

Exploit probability—

ProductFroxlor

PublishedOct 20, 2026

First seenOct 20, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

froxlor froxlor2.3.15 or later

Patches

github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a

Vendor advisories

Affected products

Product	Affected versions	Fixed in
froxlor froxlor	0.10.0 ≤ v < 2.3.15	2.3.15

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.