CVE-2026-113676
Deferred Deferred - Pending Action

Authorization Bypass in Froxlor via Admins.get API Identifier Confusion

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113676
EUVD
EUVD-2026-105092

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 0.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor versions 0.10.0 to 2.3.14 have an authorization bypass in the Admins.get API command. Resellers can exploit identifier confusion by sending their own login name with another admin's numeric ID to retrieve sensitive admin records. This allows access to contact emails, IP allow-lists, resource limits, notes, and login history without proper authorization.

Detection Guidance

To detect this vulnerability, check Froxlor versions between 0.10.0 and 2.3.14. Run 'froxlor --version' or check the web interface footer for version details. Monitor API logs for suspicious Admins.get requests with mismatched login names and admin IDs. Look for unauthorized access attempts to admin records.

Impact Analysis

Attackers with reseller access can read sensitive admin data, including contact details and resource limits. This could lead to privacy breaches, unauthorized changes to admin settings, or further exploitation of the system. The impact depends on the exposed data and system configuration.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data of admin users without consent. For HIPAA, if admin records contain protected health information, unauthorized access may breach compliance. Organizations must ensure admin data is protected to meet regulatory requirements.

Mitigation Strategies

Immediately upgrade Froxlor to version 2.3.15 or later. If upgrading is not possible, restrict API access to trusted IPs and disable reseller privileges temporarily. Review logs for past exploitation attempts and revoke any unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart