CVE-2026-41233 PUBLISHED

Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

Assigner: GitHub_M
Reserved: 18.04.2026 Published: 23.04.2026 Updated: 23.04.2026

Froxlor is open source server administration software. Prior to version 2.3.6, in Domains.add(), the adminid parameter is accepted from user input and used without validation when the calling reseller does not have the customers_see_all permission. This allows a reseller to attribute newly created domains to any other admin, bypassing their own domain quota (since the wrong admin's domains_used counter is incremented) and potentially exhausting another admin's quota. Version 2.3.6 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Product Status

Vendor froxlor
Product froxlor
Versions
  • Version < 2.3.6 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE