What is the CVSS score of EUVD-2026-25188?

EUVD-2026-25188 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-25188?

Yes, a patch is available for EUVD-2026-25188. Update the affected software to the latest version immediately.

Froxlor EUVD-2026-25188

| CVE-2026-41233 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-23 GitHub_M

Authentication Bypass Froxlor

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 27, 2026 - 16:59 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:02 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 05:00 euvd

EUVD-2026-25188

Analysis Generated

Apr 23, 2026 - 05:00 vuln.today

CVE Published

Apr 23, 2026 - 04:00 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Froxlor is open source server administration software. Prior to version 2.3.6, in Domains.add(), the adminid parameter is accepted from user input and used without validation when the calling reseller does not have the customers_see_all permission. This allows a reseller to attribute newly created domains to any other admin, bypassing their own domain quota (since the wrong admin's domains_used counter is incremented) and potentially exhausting another admin's quota. Version 2.3.6 fixes the issue.

AnalysisAI

Froxlor versions prior to 2.3.6 allow authenticated resellers to bypass domain quota restrictions by attributing newly created domains to arbitrary admins through unvalidated adminid parameter input in the Domains.add() function. This vulnerability enables quota exhaustion attacks against other administrators and domain creation beyond the attacker's assigned limits, with confirmed patch availability in version 2.3.6.

Technical ContextAI

The vulnerability exists in Froxlor's domain administration API, specifically the Domains.add() method, which accepts an adminid parameter from user-supplied input without validating whether the calling reseller has permission to assign domains to that admin. The root cause is an improper access control flaw (CWE-863: Incorrect Authorization) that fails to enforce the customers_see_all permission check before accepting the adminid parameter. When a reseller without the customers_see_all permission creates a domain, the application should restrict domain assignment to their own admin account; instead, it allows them to specify any adminid value, causing the domain quota counter (domains_used) for the specified admin to be incremented rather than the attacker's own counter. This permits attackers to circumvent their domain quota limits and manipulate quota tracking for other administrators in the system.

RemediationAI

Vendor-released patch: Froxlor 2.3.6. Administrators should immediately upgrade from any version prior to 2.3.6. The patch is available at https://github.com/froxlor/froxlor/releases/tag/2.3.6 with upstream fix confirmed in commit bf47ba15329506e9f9662f9462463932aa80dff5. No workarounds are documented for unpatched versions; upgrading is the primary mitigation. Organizations unable to patch immediately should implement compensating controls by restricting reseller account creation and auditing the Domains.add() logs for suspicious adminid parameter assignments that do not match the calling reseller's account ID. Additionally, periodically review domain quota assignments across administrators to detect manual quota manipulation. However, these controls are detective rather than preventive and do not eliminate the vulnerability; patching should be prioritized.