A flaw in Froxlor versions prior to 2.3.15 allows a reseller to retrieve full details of any administrator account, including contact email, IP allow‑lists, resource limits, notes and login history, by sending a crafted request to the Admins.get API that specifies a reseller login name and another administrator’s numeric identifier. The vulnerability grants read access to privileged data that should be restricted to administrators, leading to potential data disclosure and privacy violations.

Froxlor software deployed under the froxlor vendor is affected. The issue applies to all releases starting from 0.10.0 up to but excluding version 2.3.15. Versions 2.3.15 and later have the fix applied.

The CVSS score is 5.3, indicating a moderate severity. The exploit probability (EPSS) is not available, but the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited current exploitation. The likely attack vector involves an authenticated reseller sending a specially crafted API request; no elevation of privilege beyond existing reseller rights is required. Because the flaw exploits a logic error in request handling, it can be triggered by any reseller that can reach the affected API endpoint. The data exposed is sensitive and could be used for further attacks or privacy intrusions.