EUVD-2026-115856

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...

CVE-2026-121434

Froxlor versions 2.3.0 before 2.3.15 are vulnerable to an authorization bypass within the Certificates.add and Certificates.update API commands. The flaw exists because the system fails to verify if a domain's certificate is Let's Encrypt-managed. An attacker with API access can overwrite managed...

CVE-2026-121434: froxlor: Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API…

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an...