CVE-2026-100719: Froxlor Information Disclosure Flaw

CVE-2026-100719 Overview

CVE-2026-100719 is a credential disclosure vulnerability in Froxlor server management panel versions before 2.3.12. The flaw resides in the DirProtections.listing API command, which returns htpasswd password hashes to authenticated API callers. Any user with API access can retrieve bcrypt hashes for accounts protecting restricted web directories. Attackers can then perform offline cracking against the recovered hashes and attempt credential reuse against other services. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated API users can harvest bcrypt password hashes for every htpasswd-protected directory, enabling offline password cracking and lateral credential reuse.

Affected Products

Froxlor server administration panel versions before 2.3.12
Deployments exposing the Froxlor API to multi-tenant or reseller users
Hosting environments using Froxlor-managed directory protection with htpasswd

Discovery Timeline

2026-09-26 - CVE-2026-100719 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-100719

Vulnerability Analysis

Froxlor is a PHP-based server management panel used to administer web hosting, mail, and DNS services. The platform exposes a JSON-RPC style API that supports module-based commands, including DirProtections.listing for enumerating directory protection entries.

In versions before 2.3.12, the listing response includes the stored htpasswd password hash field alongside the username, path, and metadata. Because Froxlor uses bcrypt to generate these hashes, the exposed values are suitable for offline brute-force attacks with tools such as hashcat or john. Any authenticated API user who can invoke DirProtections.listing within their permission scope receives the hashes.

The practical risk is amplified in shared hosting environments where resellers or customer accounts hold API tokens. Credentials protecting internal admin paths, staging sites, or backup directories can be collected without triggering a login event on the target web server.

Root Cause

The root cause is overly permissive output from the API module. The listing endpoint returns the full database record for each directory protection entry rather than filtering sensitive columns such as the password hash. There is no authorization check that distinguishes between callers who need to manage a protection and those who merely need to enumerate it.

Attack Vector

Exploitation requires network access to the Froxlor API and a valid API key or session. The attacker calls DirProtections.listing, parses the JSON response, and extracts the password field containing the bcrypt hash. Hashes are then cracked offline. Recovered plaintext passwords can be reused against the protected directory itself, against the Froxlor panel, or against external services sharing the same credentials.

Technical details are documented in the GitHub Security Advisory GHSA-8wfc-9qp5-gjxf and the VulnCheck advisory for Froxlor credential disclosure.

Detection Methods for CVE-2026-100719

Indicators of Compromise

API access logs containing requests to the DirProtections.listing command, especially from non-administrative API users
Unexpected outbound traffic from the Froxlor host following API queries that enumerate directory protections
Successful HTTP basic authentication attempts against htpasswd-protected paths from new source addresses shortly after API enumeration

Detection Strategies

Audit web server and reverse proxy logs for POST requests to the Froxlor API endpoint containing the DirProtections.listing command string
Correlate API caller identity with the volume of directory protection records returned to flag bulk harvesting
Review Froxlor database access logs for queries against the panel_htpasswds table originating from unexpected contexts

Monitoring Recommendations

Enable verbose API logging in Froxlor and forward logs to a centralized SIEM for retention and search
Alert on repeated authentication failures against htpasswd-protected directories that may indicate offline-cracked credentials being replayed
Monitor Froxlor version strings in HTTP responses to identify unpatched instances across the estate

How to Mitigate CVE-2026-100719

Immediate Actions Required

Upgrade Froxlor to version 2.3.12 or later on every managed host
Rotate all htpasswd passwords configured through Froxlor, assuming the hashes may already be exposed
Invalidate and reissue Froxlor API keys issued to non-administrative users
Restrict API network reachability to trusted management networks until patching is complete

Patch Information

The maintainers resolved the issue in Froxlor 2.3.12 by removing the password hash field from the DirProtections.listing API response. Refer to the GitHub Security Advisory GHSA-8wfc-9qp5-gjxf for commit-level details and upgrade guidance.

Workarounds

Disable API access for user roles that do not require programmatic management
Place the Froxlor panel and API behind an IP allowlist or VPN until upgrade is complete
Replace shared or reused passwords on htpasswd-protected directories with unique, high-entropy values

bash

# Example: upgrade Froxlor on a Debian-based host
sudo apt update
sudo apt install --only-upgrade froxlor
froxlor-cli --version
# Verify the reported version is 2.3.12 or later