Froxlor (2.3.8 <= Version < 2.3.15) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/froxlor-2.3.8--version--2.3.15/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 16:00:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFroxlor: Information disclosure in api_keys.php (CVE-2026-121436)https://feed.craftedsignal.io/briefs/2026-11-froxlor-api-disclosure/Tue, 03 Nov 2026 16:00:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-froxlor-api-disclosure/Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure in api_keys.php that allows an administrator with customers_see_all privileges to retrieve API keys and secrets via an unscoped database query.Froxlor versions 2.3.8 through 2.3.14 contain an information disclosure vulnerability in the api_keys.php component. An administrator assigned the 'customers_see_all' permission can view the API keys and secrets of all accounts, including the super administrator, due to an improperly scoped database query. Successful exploitation allows an attacker to gain unauthorized control of the platform via API replay attacks.

Impact

Unauthorized access to API keys and secrets enables privilege escalation to super administrator level, resulting in complete control over the Froxlor instance and associated account data.

Recommendation

  • Upgrade Froxlor to version 2.3.15 or later immediately.
  • Review all API key access logs for suspicious or unauthorized usage by accounts with 'customers_see_all' privileges until the patch is applied.
  • Implement restrictive access controls for the 'customers_see_all' permission while the application remains unpatched.
]]>highadvisorywebservervulnerabilityprivilege-escalation