CVE-2026-109963

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.14

Description An insecure direct object reference exists in the email template editor at the 'admin templates.php' endpoint. The system fetches the mail body using the mailbodyid variable without verifying the adminid ownership. This allows authenticated reseller admins to access email templates belonging to other administrators, including those of the full administrator, by pairing their own subjectid with sequential foreign mailbodyid values in edit requests.

Recommendations Update to version 2.3.14 or later.