{"id":"CVE-2026-113677","published":"2026-10-20T16:17:12.453","lastModified":"2026-10-20T19:17:33.160","description":"Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/SubDomains.php#L1161-L1211","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/078e3f4ba0429390b27baae6aa1cc5d8c9a80010","tags":[]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv","tags":[]},{"url":"https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.15-missing-authorization-via-subdomains-delete-api","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv","tags":[]}],"exploitRefs":[{"url":"https://github.com/froxlor/froxlor/blob/2.3.14/lib/Froxlor/Api/Commands/SubDomains.php#L1161-L1211","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/078e3f4ba0429390b27baae6aa1cc5d8c9a80010","tags":[]},{"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.15","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv","tags":[]},{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-pp2f-frcg-w8rv","tags":[]}],"hasPoc":true,"ai":null}