CVE-2026-109963
Deferred Deferred - Pending Action

Insecure Direct Object Reference in Froxlor Email Template Editor

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109963
EUVD
EUVD-2026-98667

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in Froxlor versions before 2.3.14. It allows authenticated reseller admins to read other admins' email templates by manipulating the mailbodyid parameter in edit requests. The flaw occurs because the application does not check admin ownership when fetching email template bodies, only using the id parameter.

Detection Guidance

Check Froxlor version with 'froxlor --version' or via the web interface. If running version 2.3.13 or earlier, the system is vulnerable. Inspect admin_templates.php for improper access controls in template body retrieval.

Impact Analysis

An attacker with reseller admin access could read sensitive email templates belonging to other admins, including super-admin templates. These templates may contain customer communications like welcome emails or password reset messages with internal details, leading to information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data stored in email templates, potentially violating GDPR's data protection requirements or HIPAA's confidentiality rules regarding protected health information.

Mitigation Strategies

Upgrade Froxlor to version 2.3.14 or later immediately. Review exposed email templates for sensitive data leaks. Ensure no unauthorized access occurred by auditing template modifications and admin activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart