CVE-2026-121434— Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Quick assessment

Affected

froxlor froxlor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Froxlor 2.3.0 至 2.3.15 版本（不含 2.3.15）的和 API 命令中存在授权检查缺失漏洞：这些命令未验证目标域名的证书是否由 Let's Encrypt 管理。拥有 API 访问权限的用户可将受管证书及其私钥替换为攻击者指定的证书对，随后通过任务部署至 Web 服务器，导致 HTTPS 服务中断，并破坏 ACME 自动化流程的同步状态。

CVSS 5.4 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application T1569 · System Services

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

Source: CVE Program / CVE List V5

Vulnerability Description

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
froxlor	froxlor	2.3.0 ~ 2.3.15	-

II. Public POCs for CVE-2026-121434

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121434

请登录查看更多情报信息。

Other References for CVE-2026-121434 (2)

https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg vendor-advisory
https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121434

Same Patch Batch · froxlor · 2026-11-03 · 3 CVEs total

CVE-2026-121436	7.2 HIGH	Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
CVE-2026-121435	4.3 MEDIUM	Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

IV. Related Vulnerabilities

Same product: froxlor

Same vendor: froxlor

Same weakness: CWE-862