---
id: "CVE-2026-113676"
kind: "vulnerability"
aliases: ["CVE-2026-113676"]
title: "Froxlor: resellers can read any admin record via Admins.get"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["froxlor", "hosting", "other", "php", "self-hosted"]
not_affected_if: ["no-resellers", "version-2.3.15-or-later"]
published_at: "2026-10-20T16:17:12+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113676", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Froxlor: resellers can read any admin record via Admins.get

Froxlor's Admins.get API command, in versions from 0.10.0 before 2.3.15, confuses identifiers, so a reseller can supply their own loginname with another admin's numeric id. An attacker gets that admin's contact email, IP allow-lists, resource limits, notes and login history.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Froxlor version in the panel footer or `config.inc.php`; versions from `0.10.0` up to but not including `2.3.15` are affected.
- Confirm whether reseller accounts exist that use the API (unknown from sources if the API is enabled otherwise).

## Fix

- Upgrade Froxlor to `2.3.15` or later.
- Until upgraded, restrict reseller API access (unknown from sources for an exact workaround).

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113676

## From the sources

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_