Froxlor CVE-2026-121434

Requires an authenticated Froxlor customer account with API access enabled (panel_customers.api_allowed=1; default api.customer_default=1) and a valid API key/secret for that customer. The targeted domain must belong to the attacker and be flagged letsencrypt=1 with a server-managed certificate. No user interaction or admin privileges are needed, but exploitation is limited to the attacker's own domains - it cannot touch other tenants' certificates - and only lowers that domain into an attacker-favored HTTPS state (self-signed/expired/weak cert) plus ACME desync; the original LE private key remains non-readable. Fully fixed only by updating to 2.3.15, which applies the letsencrypt gate to Certificates.add and Certificates.update.

This is a genuine but bounded integrity/availability issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the CWE-862 classification agree with the evidence: a network-reachable API, low attack complexity, no user interaction, but low privileges required (PR:L) because the actor must be an authenticated Froxlor customer holding a valid API key, acting only on a domain they already own. Impact is correctly scored VC:N/VI:L/VA:L - the original Let's Encrypt private key stays unreadable (the 2.3.13 read-path fix is confirmed intact at runtime), so there is no confidentiality loss; the damage is overwriting the managed cert/key with an attacker-chosen pair that REBUILD_VHOST deploys, degrading HTTPS and desynchronizing ACME automation for that one domain. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with the medium 5.3 score. No CISA KEV entry and no EPSS score are present in the input, so widespread-exploitation probability cannot be quantified here - their absence is not evidence of low risk, but there is no signal of active exploitation either. A full working PoC with captured runtime output is published in the vendor GHSA advisory, which raises practical exploitability above a purely theoretical finding. Net: a legitimate same-month patch priority driven by a confirmed authorization gap and a public PoC, tempered by the self-scoped blast radius (an attacker can only degrade HTTPS on their own domains, not others').

A hosting customer with API access enabled (default api.customer_default=1) calls Certificates.update (or Certificates.add) against their own domain that is flagged letsencrypt=1, supplying an attacker-chosen certificate and private key. Because neither API command performs the letsencrypt check that the UI editor and read paths enforce, the server-managed pair is overwritten and a REBUILD_VHOST task deploys the self-signed/expired/weak certificate into the webserver, breaking HTTPS for that domain's visitors. A working PoC script with deterministic captured output is included in the GHSA advisory and was reproduced at runtime on 2.3.14, confirming HTTP 200 and the stored issuer changing from LE-Sim to Attacker.