{"id":"CVE-2026-113677","title":"Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API","summary":"Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attacker…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-862"],"vendor":"froxlor","product":"froxlor","affected":["froxlor >= 0.10.0 < 2.3.15"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T18:10:46.732619Z"},"exploitAvailable":true,"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:10:52.493Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113677","references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv","label":"GitHub Security Advisory (GHSA-pp2f-frcg-w8rv)"},{"url":"https://github.com/froxlor/froxlor/commit/078e3f4ba0429390b27baae6aa1cc5d8c9a80010"},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","label":"froxlor 2.3.15 Release Notes"},{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/SubDomains.php#L1161-L1211"},{"url":"https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-missing-authorization-via-subdomains-delete-api","label":"VulnCheck Advisory: Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-10-20T16:10:53.299Z","slug":"CVE-2026-113677","body":"## Overview\n\nFroxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.\n\n## Affected\n\n- `froxlor >= 0.10.0 < 2.3.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":226092,"id":"CVE-2026-113677","ts":1792523862941,"field":"exploit_available","old":"false","new":"true"}]}