CSRF Bypass Vulnerability in Froxlor Open Source Server Administration Software
CVE-2026-55593

6.5MEDIUM

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
18 August 2026

What is CVE-2026-55593?

Froxlor, an open-source server administration software, suffers from a vulnerability where the entry point lib/ajax.php bypasses centralized request validation before allowing state-changing requests. This flaw specifically impacts the editapikey action, which updates settings without validating a CSRF token. As a result, an unauthenticated attacker could manipulate an authenticated administrator's session, potentially adding their own IP address to an API key's allowed_from list or removing its expiration date, thereby compromising the key's intended security restrictions. This vulnerability was addressed in version 2.3.8.

Affected Version(s)

froxlor < 2.3.8

References

https://github.com/froxlor/froxlor/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/froxlor/froxlor/commit/5f540fe361e7e13...
x_refsource_MISC
https://github.com/froxlor/froxlor/releases/tag/2.3.8
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.