CVE-2026-113676

MediumCVSS 4.3/10Last modified Oct 20, 2026

Description

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
froxlorfroxlor>= 0.10.0, < 2.3.15

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1136775.4Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticaCVE-2026-1136789.9Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers toCVE-2026-1136797.0HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_toCVE-2026-113686.5The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static txCVE-2026-1136805.5HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports bufCVE-2026-1136815.5OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that CVE-2026-1136827.4Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated aCVE-2026-1136836.1VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers tCVE-2026-113697.1The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that thCVE-2026-11378.8A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formWebAuthGlobaCVE-2026-113706.4The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_CVE-2026-1137039.3SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication