Read the docs
TI-2026-84316 Aliases CVE-2026-121434GHSA-hxjh-8h5v-fp7m

Missing authorization in Froxlor lets customers overwrite managed certificates

Priority MEDIUM 57CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Froxlor from 2.3.0 before 2.3.15 has a missing authorization check (CWE-862) in the Certificates.add and Certificates.update API commands. They do not verify whether a domain's certificate is managed by Let's Encrypt. A customer with API access can overwrite the managed certificate and private key with an attacker-chosen pair, and a REBUILD_VHOST task deploys it to the webserver, which breaks HTTPS and desynchronizes ACME automation. The attacker needs low privileges, and the CVSS 4.0 vector rates the impact as low integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed froxlor (froxlor): 2.3.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
froxlorfroxlor2.3.0 to before 2.3.152.3.15Patch availableCNA
  • froxlor Vendorfroxlor Affected 2.3.0 to before 2.3.15 Fixed in 2.3.15 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*——froxlor
  • cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:* Versions — — ·froxlor

Remediation

Upgrade Froxlor to version 2.3.15 or later. The sources list no fixed version for other Froxlor releases in the affected range.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA froxlor (froxlor) Fixed in 2.3.15

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    froxlor 2.3.15

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-84318 Information disclosure in Froxlor exposes API keys via api_keys.phpPriority MEDIUM 40
    • TI-2026-84317 Authorization bypass in Froxlor lets customers create MySQL databasesPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121434
  2. 2026-11-03 Alias added: GHSA-hxjh-8h5v-fp7m
  3. 2026-11-07 CISA SSVC decision points changed
  4. 2026-11-07 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2023-00300 Command Injection in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2023-02973 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01234 Authentication Bypass by Primary Weakness in froxlor/froxlor CVSS 3.1CRITICAL 9.8
  • TI-2023-01911 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor CVSS 3.1HIGH 8.8
  • TI-2026-64867 froxlor before 2.3.12 Authentication Bypass via Session Persistence CVSS 4.0HIGH 8.7
  • TI-2026-76945 Symlink following in Froxlor enables root privilege escalation CVSS 4.0CRITICAL 9.4
See all 86 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences