CVE-2026-121436

HIGH 7.2

Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.

CWE	CWE-200
Vendor	froxlor
Product	froxlor
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new high vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

froxlor / froxlor

2.3.8 < 2.3.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v vulncheck.com: https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php

Credits

🔍 manus-pi 🔍 manus-use