Missing Authorization in Froxlor SubDomains.delete API Affects Multiple Versions
CVE-2026-113677

5.3MEDIUM

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113677?

The Froxlor platform, specifically versions before 2.3.15, contains a vulnerability within the SubDomains.delete API command that lacks proper authorization checks. This flaw allows authenticated users to delete main domains provisioned by resellers simply by providing the corresponding main domain ID. Exploiting this weakness, attackers can circumvent the web interface's restrictions, potentially orphaning virtual host, DNS, and subdomain records. Consequently, they may manipulate the subdomain count below zero, gaining unauthorized subdomain allowances which can lead to significant disruption.

Affected Version(s)

froxlor 0.10.0 < 2.3.15

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://github.com/froxlor/froxlor/commit/078e3f4ba042939...
patch
https://github.com/froxlor/froxlor/releases/tag/2.3.15
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
.