Froxlor: Information disclosure in api_keys.php (CVE-2026-121436)

Froxlor versions 2.3.8 through 2.3.14 contain an information disclosure vulnerability in the api_keys.php component. An administrator assigned the 'customers_see_all' permission can view the API keys and secrets of all accounts, including the super administrator, due to an improperly scoped database query. Successful exploitation allows an attacker to gain unauthorized control of the platform via API replay attacks.

Impact

Unauthorized access to API keys and secrets enables privilege escalation to super administrator level, resulting in complete control over the Froxlor instance and associated account data.

Recommendation

• Upgrade Froxlor to version 2.3.15 or later immediately.
• Review all API key access logs for suspicious or unauthorized usage by accounts with 'customers_see_all' privileges until the patch is applied.
• Implement restrictive access controls for the 'customers_see_all' permission while the application remains unpatched.