Froxlor before version 2.3.13 has a vulnerability (CVE-2026-100708) where the ssl_key_file column, containing raw PEM TLS private keys, is included verbatim in JSON responses of the Certificates.get and Certificates.listing API commands. This happens because the underlying domain_ssl_settings query results are passed through ApiCommand::response() without any field filtering or allowlisting. Consequently, low-privileged authenticated customers can retrieve private keys for their own domains, including Let's Encrypt keys that are otherwise protected with root-only filesystem permissions. Reseller and customers_see_all admin accounts can retrieve private keys belonging to other users. The disclosed keys enable attackers to impersonate domains, decrypt TLS traffic passively, and perform active man-in-the-middle attacks.

The vulnerability allows unauthorized disclosure of TLS private keys via API responses. This compromises the confidentiality and integrity of TLS communications for affected domains. Attackers with access to these keys can impersonate domains, decrypt intercepted TLS traffic, and conduct man-in-the-middle attacks. The impact is high confidentiality loss with limited integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users only and monitor for unauthorized API calls. Avoid exposing API credentials to untrusted parties. Follow vendor updates closely for a patch or official mitigation.