Live › vulnerability › CVE-2026-121434
Froxlor 2.3.0 before 2.3.15 lacks an authorization check in its Certificates API, so customers can overwrite a domain's Let's Encrypt-managed certificate and private key with their own pair. The attacker-chosen pair is deployed to the web server, which breaks HTTPS for the domain and desynchronizes ACME automation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Hosting providers running Froxlor 2.3.0 through 2.3.14 where customers have API access. The risk depends on customers being able to use the Certificates API against domains that have Let's Encrypt-managed certificates. Installations without customer API access are much less exposed.
No product ranges from the sources yet.
froxlor/lib/version.php, and see whether it is before 2.3.15.2.3.0 up to but not including 2.3.15: move to 2.3.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.
This page as .md · .json · in your agent: get_signal("CVE-2026-121434")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.