Live › vulnerability › CVE-2026-113677
Go to dashboardFroxlor's SubDomains.delete API command does not check authorization, so an authenticated customer can delete reseller-provisioned main domains by supplying a main domain id. The same flaw orphans vhost and DNS records and can push subdomain usage counters below zero to gain extra subdomain allowance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations running Froxlor from 0.10.0 before 2.3.15 that have customer accounts with API access and reseller-provisioned main domains. Single-tenant installs with no customer accounts are unlikely to be exposed.
No product ranges from the sources yet.
froxlor/version.inc.php, and compare it with 2.3.152.3.15 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
This page as .md · .json · in your agent: get_signal("CVE-2026-113677")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.