CVE-2026-113676

Name of the Vulnerable Software and Affected Versions Froxlor versions 0.10.0 through 2.3.14

Description An authorization bypass exists in the 'Admins.get' API endpoint. This issue occurs due to identifier confusion, allowing resellers to access any administrator record. By providing their own loginname alongside another administrator's numeric id, an attacker can retrieve sensitive information, including contact emails, IP allow-lists, resource limits, notes, and login history.

Recommendations Update Froxlor to version 2.3.15 or later. As a temporary mitigation, restrict access to the 'Admins.get' API endpoint.