Insecure Direct Object Reference in Froxlor Email Template Editor

CVE-2026-109963

What is CVE-2026-109963?

The Froxlor email template editor prior to version 2.3.14 is susceptible to an insecure direct object reference vulnerability. This flaw occurs because the mail body is retrieved using a mailbodyid without verifying the associated admin's ownership. As a result, authenticated reseller admins can manipulate requests to access and read email templates that belong to other admins, including those belonging to the full administrator. This vulnerability exposes potentially sensitive information and poses a significant risk to admin privacy and data security.

References