The flaw is a missing authorization check in Froxlor’s api.php that lets reseller users issue read commands such as MysqlServer.listing, MysqlServer.get, or Cronjobs.listing. These calls return full‑admin‑only MySQL server details—usernames, hosts, ports, TLS settings—and cronjob metadata that should be confined to administrator accounts. An attacker can thus learn sensitive configuration information that could be leveraged to access the database or manipulate scheduled tasks, compromising confidentiality and potentially enabling further compromise.

Any Froxlor installation version 0.10.0 up to and including 2.3.13 is affected; the issue is resolved in version 2.3.14 and later.

The vulnerability scores a CVSS of 5.3, indicating a medium severity. EPSS data is not available and it is not listed in CISA’s KEV. An attacker needs only an authenticated reseller account and can contact the vulnerable endpoints over the network; no code execution or privilege escalation is required, but the exposed data could be used as a foothold for more persistent attacks.