Froxlor EUVD-2026-105092

Requires a valid, authenticated reseller account on the target Froxlor instance that lacks the change_serversettings privilege (PR:L); there is no path for a fully unauthenticated attacker. Exploitation is triggered by invoking the Admins.get API command with the caller's own loginname paired with another admin's numeric id, exploiting an OR-based identity check where a mismatched id still drove the backing query. Limiting factors: the attacker must already hold reseller credentials, the result is read-only disclosure of admin metadata (no modification possible), and only versions 0.10.0 through 2.3.14 are affected (fixed in 2.3.15). No special non-default configuration or user interaction is needed beyond possessing a reseller account.

Signals are consistent and point to a moderate, not urgent, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (medium): network-reachable API, low complexity, but requires an authenticated low-privileged reseller account (PR:L) and yields only limited confidentiality impact with no integrity or availability effect. There is no EPSS score in the input and the CVE is not on CISA KEV, so there is no public evidence of active exploitation; exploitation status is best described as no public exploit identified at time of analysis, although the vendor fix commit and GHSA advisory fully disclose the bypass logic, lowering the bar to reproduce it. CWE-863 (Incorrect Authorization) and the description agree the flaw is an authorization bypass yielding read-only disclosure of another admin's metadata (contact email, IP allow-lists, resource limits, notes, login history) - this is an information-disclosure/recon issue, not remote code execution or account takeover. Net: a real but bounded issue requiring insider-level reseller access; patch promptly where untrusted resellers exist, but it is a medium-CVSS, low-real-risk item rather than an internet-wide emergency. EPSS/KEV data are absent (not conflicting) - absence of exploitation signals is expected for a freshly disclosed, access-gated information leak.

A malicious or compromised reseller on a shared Froxlor hosting server calls the Admins.get API, supplying their own loginname together with a different admin's numeric id. The identifier-confusion bypass returns the targeted admin's full record, letting the attacker harvest contact emails, IP allow-lists, resource limits, and login history for reconnaissance against higher-privileged accounts. No public weaponized exploit is available, but the patch commit publicly reveals the exact bypass condition; network vector with low complexity means the request itself is trivial to craft.