{"id":"CVE-2026-113676","kind":"vulnerability","aliases":["CVE-2026-113676"],"related":[],"title":"Froxlor: resellers can read any admin record via Admins.get","description":"Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.","summary":"Froxlor's Admins.get API command, in versions from 0.10.0 before 2.3.15, confuses identifiers, so a reseller can supply their own loginname with another admin's numeric id. An attacker gets that admin's contact email, IP allow-lists, resource limits, notes and login history.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["froxlor","hosting","other","php","self-hosted"],"not_affected_if":["no-resellers","version-2.3.15-or-later"],"how_to_check":"- Check the installed Froxlor version in the panel footer or `config.inc.php`; versions from `0.10.0` up to but not including `2.3.15` are affected.\n- Confirm whether reseller accounts exist that use the API (unknown from sources if the API is enabled otherwise).","fix":"- Upgrade Froxlor to `2.3.15` or later.\n- Until upgraded, restrict reseller API access (unknown from sources for an exact workaround).","status":"open","published_at":"2026-10-20T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:39+00:00","updated_at":"2026-10-25T04:24:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:24:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Froxlor to `2.3.15` or later.\n- Until upgraded, restrict reseller API access (unknown from sources for an exact workaround).","reach":"internet","title":"Froxlor: resellers can read any admin record via Admins.get","impact":"medium","summary":"Froxlor's Admins.get API command, in versions from 0.10.0 before 2.3.15, confuses identifiers, so a reseller can supply their own loginname with another admin's numeric id. An attacker gets that admin's contact email, IP allow-lists, resource limits, notes and login history.","category":"other","nicknames":[],"who_cares":["froxlor","self-hosted","hosting","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Reseller reads other admins' contact details, IP allow-lists and login history.","analyst_note":"","how_to_check":"- Check the installed Froxlor version in the panel footer or `config.inc.php`; versions from `0.10.0` up to but not including `2.3.15` are affected.\n- Confirm whether reseller accounts exist that use the API (unknown from sources if the API is enabled otherwise).","needs_analyst":false,"not_affected_if":["no-resellers","version-2.3.15-or-later"],"who_is_affected":"Hosting providers running Froxlor with reseller accounts that can reach the Admins.get API command are exposed, because a reseller can read other admins' records. Installs with no reseller accounts, or versions 2.3.15 and later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3339,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113676':12A,15A '-2026':11A,14A '0.10.0':31B,70C '2.3.15':33B,72C 'admin':6A,46B,54B,89C,102C 'admins.get':9A,25B,80C 'allow':60B,84C,112C 'allow-list':59B,111C 'anoth':45B,101C 'api':26B,81C 'attack':51B,94C 'author':75C 'bypass':76C 'command':27B,82C 'confus':34B,93C 'contact':56B,108C 'contain':73C 'cve':10A,13A 'email':57B,109C 'froxlor':1A,16B,23B,68C 'get':52B 'histori':67B,119C 'host':17B,22B 'id':49B,105C 'identifi':35B,92C 'ip':58B,110C 'limit':63B,115C 'list':61B,113C 'login':66B,118C 'loginnam':43B,99C 'note':64B,116C 'numer':48B,104C 'php':19B 'read':4A,87C 'record':7A,90C 'resel':2A,38B,85C 'resourc':62B,114C 'retriev':107C 'self':21B 'self-host':20B 'send':96C 'suppli':40B 'version':29B 'via':8A,91C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Hosting providers running Froxlor with reseller accounts that can reach the Admins.get API command are exposed, because a reseller can read other admins' records. Installs with no reseller accounts, or versions 2.3.15 and later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113676","severity":null,"published_at":"2026-10-20T16:17:12+00:00","modified_at":"2026-10-20T17:17:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}