CVE-2026-113676

Published: Oct 20, 2026Modified: Oct 20, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444

Source: disclosure@vulncheck.com

https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a

Source: disclosure@vulncheck.com

https://github.com/froxlor/froxlor/releases/tag/2.3.15

Source: disclosure@vulncheck.com

https://github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-api

Source: disclosure@vulncheck.com

https://github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.