CVE-2026-121434 Details
Description
Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.
A vulnerability in Froxlor versions 2.3.0 prior to 2.3.15 allows customers with API access to bypass authorization checks in the Certificates.add and Certificates.update API commands. These commands do not verify if a domain's certificate is managed by Let's Encrypt. As a result, an attacker can replace the managed certificate and private key with a chosen pair. The replacement is deployed to the webserver via a REBUILD_VHOST task, disrupting HTTPS functionality and desynchronizing ACME automation.
To address this vulnerability, the same Let's Encrypt verification check that is applied in the user interface and the read API paths should be implemented in the Certificates.add and Certificates.update API commands. This would prevent the unauthorized modification of server-managed certificates.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.14, >= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |