Froxlor versions from 2.3.8 up to but not including 2.3.15 contain an information disclosure vulnerability. This flaw allows administrators with the customers_see_all permission to view all accounts' API keys and secrets due to an unscoped database query in api_keys.php. Exploitation enables reading the super administrator's API key and secret, which can be replayed to gain super administrator control. The issue is fixed in version 2.3.15.
CVE-2026-121435 is an authorization bypass vulnerability in Froxlor versions before 2.3.15. It allows authenticated customers to create MySQL databases via the Mysqls.add API endpoint, bypassing admin restrictions that disable the MySQL feature. This occurs because the endpoint lacks the customer_hide_options check, enabling unauthorized database creation within the customer's quota despite policy settings.
Froxlor versions 2.3.0 through 2.3.14 have a missing authorization check vulnerability in the Certificates.add and Certificates.update API commands. This flaw allows customers with API access to overwrite Let's Encrypt-managed certificates and private keys with attacker-chosen values. The overwritten certificates are deployed to the webserver by a REBUILD_VHOST task, disrupting HTTPS functionality and desynchronizing ACME automation.
Froxlor versions from 0.10.0 up to but not including 2.3.14 contain a newline injection vulnerability in the Ftps.add API. Authenticated users can exploit this flaw by injecting newline characters into the additional_members parameter, which are then unsanitized when written to the root-owned NSS group database file. This can create unauthorized privileged group entries, enabling local privilege escalation. The vulnerability is fixed in version 2.3.14.
Froxlor versions prior to 2.3.12 have a vulnerability in the DirProtections.listing API command that allows authenticated API users to retrieve bcrypt password hashes from htpasswd files. This exposure enables offline cracking attempts and risks credential reuse compromise.
Froxlor versions 2.0.0 through 2.3.10 contain a stored cross-site scripting (XSS) vulnerability. This occurs when a customer uploads an SSL certificate, and the issuer organization field is stored without sanitization. The vulnerability allows attacker-supplied script to execute in the session of privileged users such as administrators or resellers. Exploitation can lead to full administrator account takeover and potential root command execution on the managed server. The issue is resolved in Froxlor version 2.3.12.
Froxlor versions through 2.3.10 have an issue where sensitive columns, specifically the dkim_privkey field, are not filtered from API responses in certain domain-related API calls. This allows authenticated non-superadmin admins with the delegated customers_see_all flag to access DKIM private keys of other tenants' domains. The vulnerability enables unauthorized reading of private signing keys, which could be used to sign emails that pass DKIM verification and DMARC alignment. The issue was fixed in version 2.3.12.
froxlor versions up to 2.3.10 contain a vulnerability where an unauthenticated GET request to the two-factor authentication (2FA) management page disables a user's 2FA without confirmation or re-authentication. This occurs because the global CSRF protection does not cover GET requests, and the session cookie's SameSite=Lax setting allows cross-site navigation to carry the session, enabling silent 2FA disablement. Both customer and admin 2FA handlers are affected. The issue is fixed in version 2.3.12.
Froxlor versions 2.3.10 and earlier have a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron job. This flaw allows a local user with shell access to exploit a race between symlink validation and file write operations, potentially leading to root-level compromise of the host running the Froxlor panel. The vulnerability is fixed in version 2.3.12.
Froxlor versions up to and including 2.3.10 have a critical vulnerability where the system.letsencryptchallengepath setting is not properly restricted or escaped. This allows an administrator or any actor able to write settings to inject arbitrary command-line options into the acme.sh command executed by root via cron, leading to arbitrary command execution or file writes as root. The issue is fixed in version 2.3.12.
Froxlor versions up to 2.3.10 have a vulnerability where the mail.allow_external_domains policy is not enforced in the EmailSender.add API command. This allows an authenticated customer with API access to register arbitrary external sender addresses despite policy settings that should prevent this. The issue creates a bypass between the administrator UI configuration and the API, enabling sender spoofing by authorizing sender identities outside the hosted domains. The vulnerability is fixed in version 2.3.12.
Froxlor versions through 2.3.10 have a vulnerability in their two-factor authentication (2FA) remembered-token mechanism. The system stores only a numeric user ID in remembered-2FA tokens without recording the account namespace, causing token lookups to be ambiguous between customer and administrator accounts. This allows an attacker who controls a customer account with a colliding ID and a valid remembered-2FA token, and who knows the administrator's password, to bypass the administrator's TOTP second factor and gain an authenticated administrator session. This vulnerability affects only the second-factor authentication step and does not bypass password authentication. The issue is fixed in version 2.3.12.
In froxlor versions 2.3.10 and earlier, the URL validation function Validate::validateUrl does not properly inspect the userinfo component of URLs for carriage return and line feed characters. This allows an authenticated low-privilege user with subdomain creation rights to inject malicious payloads into the web server configuration. The injected directives can execute with root privileges, enabling server-wide impact such as response hijacking or local file reading. The vulnerability is fixed in version 2.3.12.
Froxlor versions before 2.3.13 expose the raw PEM TLS private key content in JSON API responses for certificate-related commands. This occurs because the ssl_key_file column is returned verbatim without filtering, allowing low-privileged authenticated API users to access private keys of their own domains. Reseller and admin accounts with broader privileges can access private keys of other users. Exposure of these private keys can lead to domain impersonation, passive decryption of TLS traffic, and man-in-the-middle attacks.
Froxlor versions through 2.3.10 contain a vulnerability allowing authenticated users with write access to an FTP home directory to cause arbitrary file deletion via symlink following in a root-executed cron task. This occurs because the FTP data deletion cron job improperly handles symlinks, leading to potential cross-tenant data destruction and denial of service. The issue is resolved in Froxlor version 2.3.12.
Froxlor versions 2.3.10 and earlier contain a critical vulnerability in the customer data-export cron job. The vulnerability arises from improper validation of intermediate path components in the export destination, allowing an authenticated customer to create symlinks that cause the cron job to recursively change ownership of arbitrary directories, including sensitive system paths. This can lead to host root and cross-tenant compromise. The issue is fixed in Froxlor version 2.3.12.
froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.