Froxlor CVE-2026-100719

Requires an authenticated Froxlor API session (PR:L) with access to invoke the DirProtections.listing API command; exploitation is network-reachable and needs no user interaction. It applies to Froxlor installations before 2.3.12 that use the directory-protection (htpasswd) feature - if no protected directories are configured, there are no hashes to disclose. Impact is confidentiality-only and further limited by bcrypt's cost: disclosed hashes still require offline cracking, so realized harm depends on weak or reused passwords rather than immediate plaintext exposure.

Signals are consistent and point to a real but moderate-severity issue rather than an urgent priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 (High), driven entirely by high confidentiality impact with no integrity or availability effect - accurate for a credential-disclosure flaw. The PR:L requirement means an attacker must already hold valid authenticated API access, which is a meaningful gatekeeper and downgrades real-world urgency. No EPSS score, no CISA KEV listing, and no public POC are present in the data, indicating no evidence of active or automated exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The disclosed material is bcrypt hashes, which are computationally expensive to crack, so impact is delayed and probabilistic (dependent on password strength and reuse) rather than immediate. Net: a legitimate confidentiality bug worth patching, but not a drop-everything emergency - the PR:L barrier, bcrypt cost factor, and absence of exploitation signals all temper the 7.1 rating.

An attacker holding valid but low-privilege Froxlor API credentials (or a compromised low-tier reseller/customer API token) invokes the DirProtections.listing API command and receives bcrypt htpasswd hashes for protected-directory users. The attacker cracks weak hashes offline and reuses recovered passwords against the same or other services where the directory users reused credentials. No public exploit code is identified at time of analysis.