CVE-2026-113677
Deferred Deferred - Pending Action

Froxlor Missing Authorization in SubDomains.delete API

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113677
EUVD
EUVD-2026-105093

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 0.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113677 is a missing authorization vulnerability in Froxlor versions 0.10.0 through 2.3.14. It allows authenticated customers to delete reseller-provisioned main domains via the SubDomains.delete API command by supplying a main domain ID. This bypasses UI restrictions and can orphan virtual hosts, DNS records, and subdomains. The flaw stems from insufficient validation of the parentdomainid parameter, enabling customers to target main domains (where parentdomainid equals 0) for deletion.

Detection Guidance

To detect this vulnerability, check Froxlor API logs for SubDomains.delete API calls where parentdomainid=0 is used by non-admin customers. Review domain deletion events and verify if main domains were removed by unauthorized users. Compare installed Froxlor version against 2.3.15 or later.

Impact Analysis

Attackers can exploit this to delete main domains, causing loss of reseller-provisioned domains and orphaned resources like virtual hosts and DNS records. It may also drive the subdomains_used count below zero, allowing attackers to gain extra subdomain allowance. This could disrupt hosted services and lead to unauthorized modifications in domain configurations.

Compliance Impact

The vulnerability allows unauthorized deletion of main domains, which could lead to loss of critical data and misconfiguration of DNS records. This may violate data integrity and availability requirements under GDPR and HIPAA, potentially resulting in non-compliance due to unauthorized modifications and data loss.

Mitigation Strategies
  • Upgrade Froxlor to version 2.3.15 or later immediately to patch the vulnerability.
  • Audit API logs for any unauthorized domain deletions, especially those involving main domains (parentdomainid=0).
  • Review domain and subdomain configurations for orphaned records or quota inconsistencies.
  • Restrict API access to trusted users and monitor for suspicious SubDomains.delete API calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...