---
id: CVE-2026-113676
title: Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
summary: >-
  Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass
  vulnerability in the Admins.get API command that allows resellers to read any
  admin record via identifier confusion. Attackers can send their own loginname
  with another a…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: froxlor
product: froxlor
affected:
  - froxlor >= 0.10.0 < 2.3.15
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T16:20:34.356548Z'
exploitAvailable: true
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:20:58.011Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113676'
references:
  - url: 'https://github.com/froxlor/froxlor/security/advisories/GHSA-m7gc-8c8g-4f89'
    label: GitHub Security Advisory (GHSA-m7gc-8c8g-4f89)
  - url: >-
      https://github.com/froxlor/froxlor/commit/981400f36a0c3b5a7012e15a17dfc5fe7146fa0a
  - url: 'https://github.com/froxlor/froxlor/releases/tag/2.3.15'
    label: froxlor 2.3.15 Release Notes
  - url: >-
      https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/Admins.php#L434-L444
  - url: >-
      https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-authorization-bypass-via-admins-get-api
    label: >-
      VulnCheck Advisory: Froxlor 0.10.0 before 2.3.15 Authorization Bypass via
      Admins.get API
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-20T16:10:53.299Z'
---

## Overview

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

## Affected

- `froxlor >= 0.10.0 < 2.3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.