{"schemaVersion":3,"id":"CVE-2026-113676","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.","dates":{"published":"2026-10-20T15:40:38.273Z","modified":"2026-10-20T16:20:58.011Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"froxlor","product":"froxlor","name":"froxlor","label":"froxlor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.10.0, < 2.3.15","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.10.0, < 2.3.15","eol":null,"hubHref":"/vendor/froxlor/froxlor"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89","label":"github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89","hostname":"github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a","label":"github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a","hostname":"github.com","tags":["Patch"]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","label":"github.com/froxlor/froxlor/releases/tag/2.3.15","hostname":"github.com","tags":["Release Notes"]},{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444","label":"github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php","hostname":"github.com","tags":["Technical Description"]},{"url":"https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-api","label":"www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-api","hostname":"www.vulncheck.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-20T15:40:38.273Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-20T16:20:58.011Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T12:22:39.868Z","stale":false,"partial":false}}