CVE-2026-90767

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

Froxlor 2.3.7 through 2.3.8 in the API commands Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing returns full database rows without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8.

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

Vulnerability in Froxlor before version 2.3.8. The lib/ajax.php entry point bypasses centralized request validation, and the editapikey action does not validate a CSRF token. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions.

Froxlor before version 2.3.8 has a vulnerability in the DomainZones.add API command that does not reject line delimiters, tab characters, semicolons, or unsupported DNS record types before serializing values into a BIND zone file. An authenticated customer with DNS-zone permissions can inject additional resource-record lines, bypassing field-level validation. BIND accepts the injected records, allowing modification of DNS data and potential DNS availability impact.

Froxlor before version 2.3.8 contains a SQL Injection vulnerability in the Admins.add and Admins.update endpoints, where an attacker-controlled ipaddress array is stored and later concatenated into a SQL IN clause without parameterization. An authenticated administrator with change_serversettings permission can exploit this to retrieve arbitrary database data, including admin credentials.

Froxlor before version 2.3.8 contains a Stored XSS vulnerability in DNS TXT record content, which is not properly escaped before rendering in the admin panel. An authenticated customer with DNS editor access can inject JavaScript that executes in the administrator's browser session.

Froxlor before version 2.3.7 contains a vulnerability in the API authentication path that does not require a second factor (2FA) for accounts with two-factor authentication enabled. An attacker who obtains an API key and secret can access API functions without providing the TOTP code, potentially exposing or modifying customer data, domains, email and FTP accounts, databases, DNS records, and certificate material.