Authorization Bypass in Froxlor 2.3.0 by Froxlor
CVE-2026-121434

5.3MEDIUM

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121434?

Inversions in Froxlor versions prior to 2.3.15 reveal a significant security risk due to a missing authorization check in the Certificates.add and Certificates.update API commands. This vulnerability allows authenticated users with API access to modify a domain's SSL certificates indiscriminately, including overwriting legitimate Let's Encrypt certificates with unauthorized ones. Consequently, this can lead to HTTPS failures and disrupt the automated management of certificates through ACME, resulting in insecure connections and potential exposure of sensitive data.

Affected Version(s)

froxlor 2.3.0 < 2.3.15

froxlor 2.3.15

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/froxlor-2.3.0-before...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hama1cco
.