CVE-2026-41233

MEDIUM 5.4

Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from user input and used without validation when the calling reseller does not have the `customers_see_all` permission. This allows a reseller to attribute newly created domains to any other admin, bypassing their own domain quota (since the wrong admin's `domains_used` counter is incremented) and potentially exhausting another admin's quota. Version 2.3.6 fixes the issue.

CWE	CWE-863
Vendor	froxlor
Product	froxlor
Published	Apr 23, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new medium vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

froxlor / froxlor

< 2.3.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-jvx4-xv3m-hrj4 github.com: https://github.com/froxlor/froxlor/commit/bf47ba15329506e9f9662f9462463932aa80dff5 github.com: https://github.com/froxlor/froxlor/releases/tag/2.3.6