CVE-2026-113677

Name of the Vulnerable Software and Affected Versions Froxlor versions 0.10.0 through 2.3.14

Description An authorization flaw exists in the 'SubDomains.delete' API endpoint. Authenticated customers can exploit this by providing a main domain id to delete main domains provisioned by resellers. This allows attackers to bypass web UI restrictions to remove domains and orphan vhost, DNS, and subdomain records. Additionally, this can be used to manipulate the subdomains used variable to a value below zero, granting unauthorized extra subdomain allowance.

Recommendations Update Froxlor to version 2.3.15 or later. As a temporary mitigation, restrict access to the 'SubDomains.delete' API endpoint.