CVE-2026-121436
Deferred Deferred - Pending Action

Information Disclosure in Froxlor Admin Panel

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121436
EUVD
EUVD-2026-115858

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 2.3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121436 is an information disclosure vulnerability in Froxlor versions 2.3.8 to 2.3.15. It allows administrators with the customers_see_all privilege to view all API keys and secrets in the system, including those of the super administrator, due to an unscoped database query in api_keys.php. The detail modal exposes these secrets in plaintext, enabling attackers to reuse them for unauthorized API access and gain super administrator control.

Detection Guidance

Check Froxlor versions between 2.3.8 and 2.3.14 for the vulnerability. Inspect api_keys.php for unscoped queries and verify if administrators with customers_see_all can view all API keys and secrets in the detail modal.

Impact Analysis

If you are an administrator with customers_see_all privileges, an attacker could exploit this to steal API keys and secrets, gaining full control over the Froxlor system. Even without direct access, if you are a super administrator, your credentials could be exposed and misused to impersonate you or other users, leading to unauthorized actions, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of API keys and secrets may result in data breaches, triggering compliance violations, legal penalties, and reputational damage due to failure to protect personal or health information.

Mitigation Strategies

Upgrade Froxlor to version 2.3.15 or later to address the improper scoping and secret exposure. Ensure API authentication includes owner checks and restrict customers_see_all privileges to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...