{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afroxlorfroxlor2.3.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:froxlor:froxlor:2.3.8:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-121436"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Froxlor (2.3.8 \u003c= version \u003c 2.3.15)"],"_cs_severities":["high"],"_cs_tags":["webserver","vulnerability","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Froxlor"],"content_html":"\u003cp\u003eFroxlor versions 2.3.8 through 2.3.14 contain an information disclosure vulnerability in the api_keys.php component. An administrator assigned the 'customers_see_all' permission can view the API keys and secrets of all accounts, including the super administrator, due to an improperly scoped database query. Successful exploitation allows an attacker to gain unauthorized control of the platform via API replay attacks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized access to API keys and secrets enables privilege escalation to super administrator level, resulting in complete control over the Froxlor instance and associated account data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Froxlor to version 2.3.15 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview all API key access logs for suspicious or unauthorized usage by accounts with 'customers_see_all' privileges until the patch is applied.\u003c/li\u003e\n\u003cli\u003eImplement restrictive access controls for the 'customers_see_all' permission while the application remains unpatched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T16:00:11Z","date_published":"2026-11-03T16:00:11Z","id":"https://feed.craftedsignal.io/briefs/2026-11-froxlor-api-disclosure/","summary":"Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure in api_keys.php that allows an administrator with customers_see_all privileges to retrieve API keys and secrets via an unscoped database query.","title":"Froxlor: Information disclosure in api_keys.php (CVE-2026-121436)","url":"https://feed.craftedsignal.io/briefs/2026-11-froxlor-api-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:froxlor:froxlor:2.3.8:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}