PT-2026-111558

Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor admin templates.php because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign...