Live › vulnerability › CVE-2026-113676
Go to dashboardFroxlor's Admins.get API command, in versions from 0.10.0 before 2.3.15, confuses identifiers, so a reseller can supply their own loginname with another admin's numeric id. An attacker gets that admin's contact email, IP allow-lists, resource limits, notes and login history.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosting providers running Froxlor with reseller accounts that can reach the Admins.get API command are exposed, because a reseller can read other admins' records. Installs with no reseller accounts, or versions 2.3.15 and later, are not affected.
No product ranges from the sources yet.
config.inc.php; versions from 0.10.0 up to but not including 2.3.15 are affected.2.3.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.
This page as .md · .json · in your agent: get_signal("CVE-2026-113676")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.