Froxlor CVE-2026-100710

Requires an authenticated Froxlor admin account that is NOT superadmin but holds the delegated customers_see_all flag; exploitation is via the authenticated API methods Domains.get, Domains.listing, SubDomains.get, or the admin branch of SubDomains.listing, which perform an unfiltered wildcard SELECT over panel_domains and return dkim_privkey. Limiting factors: high privilege is required (delegated multi-admin/reseller-style access), so single-tenant or superadmin-only deployments are not exposed cross-tenant; the flaw only matters in multi-tenant configurations where customers_see_all has been granted to a partially-trusted admin. No user interaction and no non-standard configuration beyond that privilege grant are needed.

This is a real but bounded risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H, all other impacts N) is internally consistent with the description: a confidentiality-only disclosure requiring an authenticated, high-privilege actor (a non-superadmin admin holding the delegated customers_see_all flag). PR:H is the dominant limiting factor - this is not remotely exploitable by an anonymous attacker, so it will not see mass automated exploitation. There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis'; these signals are consistent (low-probability, no active exploitation) rather than conflicting. The impact, however, is qualitatively serious: leaked DKIM private keys enable durable email spoofing that passes DKIM/DMARC for other tenants' domains, and a single listing call dumps every visible domain's key. Net: a genuine cross-tenant confidentiality flaw that multi-tenant hosting providers should patch promptly, but not an emergency-patch-tonight, mass-scanned issue given the PR:H gate. Note the value lies in trust/integrity of downstream email even though CVSS scores it purely as confidentiality.

A hosting provider grants a reseller or junior admin the customers_see_all flag without full superadmin rights. That admin calls Domains.listing (or SubDomains.listing) via the API, receiving the raw panel_domains rows including dkim_privkey for every visible domain across other tenants, then uses the harvested private keys to sign phishing email that passes DKIM verification and DMARC alignment for those domains. No public exploit code is known, and exploitation requires the authenticated delegated-admin privilege.