An AJAX endpoint in Froxlor bypasses the centralized request validation and allows state‑changing requests without a CSRF token. The editapikey action updates the allowed_from and valid_until fields of an API key based solely on a valid session. This flaw lets an attacker force an authenticated administrator’s browser to submit a forged request, thereby adding an attacker‑controlled IP address to an API key’s allowed_from list or extending its expiration. The weakness is a classic CSRF vulnerability (CWE‑352).

Froxlor, all releases prior to version 2.3.8 are affected. The issue is fixed in 2.3.8 and later.

The severity is moderate with a CVSS score of 6.5. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker must rely on social engineering to trick an admin into loading a malicious page that triggers the forged request. Once the API key’s restrictions are weakened, an attacker may abuse the key to perform privileged API actions, effectively gaining a level of authority beyond the original key limits.