Description
Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customers_see_all admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks.
Published: 2026-09-26
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Private Key Disclosure
Action: Immediate Patch
AI Analysis

Impact

Froxlor prior to 2.3.13 exposes the content of the ssl_key_file column through the Certificates API. The API returns the PEM‑encoded private key verbatim in JSON, enabling any authenticated API caller to read the private key for their own certificates and, for reseller and customers_see_all admins, for other principals as well. The disclosed keys allow domain impersonation, passive decryption of TLS traffic, and active man‑in‑the‑middle attacks.

Affected Systems

The vulnerability affects all installations of Froxlor before version 2.3.13. Customers, resellers, and administrators with API access can be impacted regardless of file‑system permissions. The issue is present in all generic builds of the open‑source Froxlor application.

Risk and Exploitability

The CVSS score is 7.1, indicating medium severity. Exposure occurs through the API after authentication, so an attacker must have valid credentials for the Froxlor web interface. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Because the private keys are delivered in clear text, exploitation can be performed remotely by simply invoking the API, making the vulnerability highly actionable.

Generated by OpenCVE AI on September 26, 2026 at 16:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Froxlor to version 2.3.13 or later, which removes the API field leaking the private key.
  • Regenerate all TLS certificates after applying the patch to replace any keys that may have already been exposed.
  • Limit API access for ordinary customers or disable the Certificates API for non‑admin principals until a secure configuration can be ensured.

Generated by OpenCVE AI on September 26, 2026 at 16:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domain_ssl_settings queries are passed through ApiCommand::response() without any field stripping or allowlist. A low-privileged authenticated customer API caller can retrieve the private keys of their own domains' certificates, including Let's Encrypt keys that Froxlor generates server-side and stores root-only (0600) and to which the customer otherwise has no filesystem access; reseller and customers_see_all admin accounts can dump the private keys of other principals through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks.
Title Froxlor before 2.3.13 Private Key Disclosure via Certificates API
First Time appeared Froxlor
Froxlor froxlor
Weaknesses CWE-200
CPEs cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*
Vendors & Products Froxlor
Froxlor froxlor
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Froxlor Froxlor
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-28T14:49:50.160Z

Reserved: 2026-09-26T02:40:23.372Z

Link: CVE-2026-100708

cve-icon Vulnrichment

Updated: 2026-09-28T14:49:46.244Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T14:16:56.153

Modified: 2026-09-28T15:17:11.077

Link: CVE-2026-100708

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T17:45:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor