Live › vulnerability › CVE-2026-121436
Froxlor versions from 2.3.8 before 2.3.15 let an administrator with the customers_see_all permission list every account's API key and secret through an unscoped database query in api_keys.php. An attacker who reads the super administrator's key and secret can replay them against the API to take full super administrator control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Hosting teams running self-hosted Froxlor from 2.3.8 up to but not including 2.3.15 are exposed, and only administrators holding customers_see_all can exploit it. Installations on 2.3.15 or later, or with no administrators holding that permission, are not affected.
No product ranges from the sources yet.
customers_see_all permission.2.3.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.
This page as .md · .json · in your agent: get_signal("CVE-2026-121436")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.