Description
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
Published: 2026-10-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Deletion of Domains
Action: Immediate Patch
AI Analysis

Impact

Froxlor versions 0.10.0 up to 2.3.14 contain a missing authorization flaw (CWE-862) in the SubDomains.delete API command. Authenticated users can supply a main domain ID to delete reseller‑provisioned main domains. This can orphan virtual hosts, DNS entries, and subdomain records, and it manipulates the subdomains_used counter to grant additional subdomain allowances.

Affected Systems

The vulnerability affects Froxlor installations running any version from 0.10.0 through 2.3.14. Users with authenticated API access to SubDomains.delete are impacted.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity, and the exploitability operating only for authenticated users. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers can bypass the web UI restriction by directly calling the vulnerable API endpoint, thereby deleting domains and disrupting service.

Generated by OpenCVE AI on October 20, 2026 at 17:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Froxlor to version 2.3.15 or later to receive the authorization fix.
  • If an immediate upgrade is not possible, apply the commit 078e3f4ba from the Froxlor repository that implements the missing authorization check.
  • Limit API access to administrators only and regularly audit SubDomains API usage to detect unauthorized activity.

Generated by OpenCVE AI on October 20, 2026 at 17:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
Title Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
First Time appeared Froxlor
Froxlor froxlor
Weaknesses CWE-862
CPEs cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*
Vendors & Products Froxlor
Froxlor froxlor
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Froxlor Froxlor
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-20T18:10:52.493Z

Reserved: 2026-10-20T14:50:54.754Z

Link: CVE-2026-113677

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-20T16:17:12.453

Modified: 2026-10-20T16:17:12.570

Link: CVE-2026-113677

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T18:30:16Z

Weaknesses