Froxlor CVE-2026-113677

Requires a valid authenticated Froxlor customer account (PR:L) and direct invocation of the SubDomains.delete API command with the id of a main domain (parentdomainid=0) provisioned to that customer by a reseller/admin. The specific condition is that the delete authorization check existed only in the web UI (customer_domains.php: domains_cantdeletemaindomain) and was absent from the API handler, so the attacker must call the API rather than go through the UI. Limiting factors: exploitation is confined to Froxlor 0.10.0 before 2.3.15, requires pre-existing low-privileged credentials (no anonymous access), needs no user interaction or elevated privileges, and impact is bounded to domains the attacker's own account is associated with.

This is a medium-severity authorization flaw, not a top-tier priority. The CVSS 4.0 base score of 5.3 aligns with the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L: network-reachable via the API, low complexity, but requiring an existing low-privileged (authenticated customer) account and yielding only limited integrity and availability impact with no confidentiality loss. Exploitation status is 'no public exploit identified at time of analysis' - the CVE is not in CISA KEV, no EPSS score was supplied, and no POC is referenced (VulnCheck and the GHSA advisory describe the flaw but no weaponized exploit is cited). The signals are internally consistent: a logic/authorization bug that an authenticated tenant can trigger, bounded to the hosting environment the attacker already has access to, so real-world risk is best characterized as insider/tenant abuse rather than mass external compromise. No conflicting signals were observed between the CVSS vector and the description; both indicate authenticated, network-facing API abuse with limited impact.

A customer with a valid Froxlor account calls the SubDomains.delete API directly (bypassing the web UI's domains_cantdeletemaindomain restriction) and supplies the id of a reseller-provisioned main domain (parentdomainid=0) assigned to them. The deletion orphans the associated vhost, DNS, and subdomain records and drives the subdomains_used counter below zero, granting the attacker extra subdomain allowance. No public exploit code is identified, but the flaw is trivially reproducible for any authenticated customer given the documented API command.