Froxlor CVE-2026-121436

Exploitation requires an authenticated Froxlor administrator account whose customers_see_all flag is set to 1 and api_allowed is 1 - for example a reseller - and does NOT require change_serversettings; the only gate on the page (api_keys.php:40-46) merely redirects when api_allowed==0. When that condition holds, the admin area listing takes the unscoped else branch (api_keys.php:171-177) that appends the literal predicate '1', returning every api_keys row including the super administrator's, and the detail modal renders the full apikey and secret verbatim with no truncation or owner/privilege check. The disclosed secret is directly replayable because ApiCommand::readUserData (lib/Froxlor/Api/ApiCommand.php:158) matches submitted apikey/secret verbatim with no owner check. Limiting factors: the attacker must first obtain a privileged multi-tenant admin account (PR:H), so single-super-admin installations with no lower-privileged admin have no one positioned to abuse the flaw; no user interaction or special platform is otherwise needed, and default behavior of the vulnerable branch is affected (no non-default configuration required beyond the privilege flags).

This is a credible, prioritize-this-week issue rather than a theoretical high-CVSS inflation, but its real-world urgency is tempered by a meaningful privilege prerequisite. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, base 8.6) shows a network-reachable, low-complexity attack with no user interaction, but PR:H confirms the attacker must already hold a privileged Froxlor admin account - specifically one with customers_see_all=1 and api_allowed=1 (e.g., a reseller). The genuine severity comes from the escalation: a limited reseller admin reads the super administrator's plaintext apikey and secret and replays them for full super-admin takeover, so the confidentiality/integrity/availability impacts are real and directly demonstrated by the advisory's end-to-end proof. Signals are largely consistent: vuln.today assigns a 'this_week' decision label and VulnCheck is the reporter, aligning with a serious-but-not-emergency posture. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active, widespread exploitation - the risk is driven by exploit tractability and a published PoC, not by observed in-the-wild use. Net: elevated priority for any multi-admin/reseller Froxlor deployment, lower for single-super-admin installs where no lower-privileged admin exists to abuse the flaw.

A reseller administrator (or any admin granted customers_see_all and api_allowed but not change_serversettings) logs into the Froxlor panel, opens index.php?page=apikeys, and the listing runs an unscoped 'WHERE 1' query that returns every account's API key row. The attacker opens the detail modal for the super administrator's key, reads the full plaintext apikey and secret from the rendered HTML, and replays them to /api.php via HTTP Basic auth to gain full super-administrator control and impersonate every customer. The advisory includes a PoC that reproduces the exact production query strings and the API authentication match, demonstrating the leak and the replay end to end.