CVE-2026-113677
CVE-2026-113677 · Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.
CVSS 5.3 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
froxlor
- Versiones
- ≥ 0.10.0, < 2.3.15: Afectada (semver)
Actualiza a 2.3.15
Fuentes originales
- https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv
- https://github.com/froxlor/froxlor/commit/078e3f4ba0429390b27baae6aa1cc5d8c9a80010
- https://github.com/froxlor/froxlor/releases/tag/2.3.15
- https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/SubDomains.php#L1161-L1211
- https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-missing-authorization-via-subdomains-delete-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-113677