Froxlor 2.3.6 allows an authenticated customer with shell delegation to assign any shell, bypassing the configured whitelist of system.available_shells. This authorization bypass enables the attacker to specify shells such as /bin/bash, which are then applied to the system account database, granting the user real shell access on the host. The weakness is an improper authorization check, identified as CWE-863.

The vulnerability affects Froxlor by froxlor version 2.3.6. The fix is contained in release 2.3.7, and earlier versions remain susceptible.

The flaw carries a CVSS score of 8.6, indicating high severity. EPSS data is unavailable, but the lack of a KEV listing suggests no known public exploits. Because the attacker must be authenticated as a customer and shell delegation must be enabled, the risk is limited to environments where such delegation is enabled and the UI does not enforce the allowed shell list on the server side. Nonetheless, once exploited, the attacker gains system shell access, representing a major confidentiality, integrity, and availability threat.