CVE-2026-55593

Received Received - Intake

CSRF in Froxlor Admin Panel API Key Management

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-55593

EUVD

EUVD-2026-61220

Affected Vendors & Products

Vendor	Product	Version / Range
froxlor	froxlor	2.3.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Froxlor is server administration software with a vulnerability in versions prior to 2.3.8. The issue involves a bypass of request validation in the standalone lib/ajax.php entry point. An unauthenticated attacker can trick an authenticated administrator into submitting a forged request that modifies API key security settings without proper CSRF token validation.

Detection Guidance

Check Froxlor version with 'grep -r "define('FroxlorVersion" /path/to/froxlor' or 'dpkg -l | grep froxlor'. If version is below 2.3.8, the system is vulnerable. Inspect web server logs for suspicious API key modification requests targeting /lib/ajax.php with editapikey action.

Impact Analysis

An attacker could add their own IP address to an API key's allowed_from list, allowing unauthorized access. They could also remove the expiration date of an API key, making it permanently valid. This weakens API key security and could lead to unauthorized server administration or data access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If API keys are compromised, attackers may gain administrative control over servers handling personal or health data, resulting in non-compliance with data protection regulations.

Mitigation Strategies

Upgrade Froxlor to version 2.3.8 or later immediately. If immediate upgrade is not possible, restrict access to /lib/ajax.php via web server configuration (e.g., Apache .htaccess or Nginx location block) to trusted IPs only until patched.

Hi! I’m here to help you understand CVE-2026-55593. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70