CVE-2026-62988

Received Received - Intake

Information Disclosure in Froxlor Server Admin Panel

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-62988

EUVD

EUVD-2026-61216

Affected Vendors & Products

Vendor	Product	Version / Range
froxlor	froxlor	From 2.3.7 (inc) to 2.3.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Froxlor server administration software versions 2.3.7 to 2.3.8. It involves API commands that return full database rows including sensitive fields like password hashes and TOTP seeds without proper redaction. An authenticated API user with access to these endpoints could retrieve customer, admin, and FTP credentials, enabling potential account takeover and defeating two-factor authentication.

Detection Guidance

Check Froxlor API logs for suspicious access to Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, or Ftps.listing endpoints. Verify if responses include password or data_2fa fields. Inspect network traffic for unauthorized API calls to these endpoints.

Impact Analysis

If you use Froxlor versions 2.3.7 to 2.3.8, an attacker with API access could obtain your password hashes and TOTP seeds. They could crack the hashes offline to gain access to your account or generate valid second-factor codes to bypass authentication. This could lead to complete compromise of your hosting panel or hosted resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating confidentiality requirements under GDPR and HIPAA. Exposure of password hashes and TOTP seeds may constitute a data breach, requiring notification to authorities and affected individuals under these regulations.

Mitigation Strategies

Upgrade Froxlor to version 2.3.8 or later immediately. Review API access logs for unauthorized access. Rotate all passwords and 2FA secrets for affected accounts. Restrict API access to trusted IPs if possible.

Hi! I’m here to help you understand CVE-2026-62988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70