Froxlor CVE-2026-109963

Requires a valid authenticated reseller admin account on a multi-tenant Froxlor installation (versions before 2.3.14) that hosts multiple administrators/resellers whose email templates are worth reading. The specific trigger is the email template editor in admin_templates.php, where an edit request lets the attacker supply their own subjectid alongside an arbitrary, sequentially-guessable foreign mailbodyid that is fetched without an adminid ownership check. Limiting factors: exploitation is impossible for unauthenticated users (PR:L), yields only read access to template content (no write/modify, no code execution), and provides no value in single-admin deployments where there are no other tenants' templates to disclose.

This is a moderate, authorization-boundary issue rather than a high-urgency emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the equivalent base score of 5.3 align well with the description: exploitation is network-reachable and low-complexity but requires an existing authenticated reseller admin account (PR:L), and the only impact is low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N). All signals are internally consistent - there is no CVSS-versus-description conflict here. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set; by the precision rules, absence of these is not evidence of safety but does mean there is no confirmed exploitation or published exploit code to raise priority. The dominant risk reducer is that the attacker must already be a trusted-tenant reseller admin, so the realistic threat is a malicious or compromised reseller reading other tenants' and the full administrator's email templates - a multi-tenant trust-boundary leak, not a remote-unauthenticated breach. Net: real but low-to-moderate priority, warranting patching to 2.3.14 in multi-reseller hosting environments while not demanding break-glass response.

A malicious or compromised reseller admin logged into a shared Froxlor hosting panel opens the email template editor and, in an edit request, keeps their own subjectid while substituting sequential mailbodyid values belonging to other admins. Because admin_templates.php fetches the mail body by mailbodyid without verifying adminid ownership, the attacker reads other resellers' and the top-level administrator's email templates. No public exploit code was identified at time of analysis, but the technique is trivial to reproduce by hand.