Medium severity · published Oct 20, 2026
CVE-2026-113676
Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
froxlor · froxlor
0.10.0 before 2.3.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113676
github.com
https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444
github.com
https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a
github.com
https://github.com/froxlor/froxlor/releases/tag/2.3.15
github.com
https://github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89
www.vulncheck.com
https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-api
More from froxlor
9.9
CVE-2026-113678
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
9.9
CVE-2026-100717
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
9.9
CVE-2026-100716
Froxlor before 2.3.12 Privilege Escalation via Symlink
9.9
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
9.9
CVE-2026-41228
Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution