CVE-2026-41233: Froxlor Auth Bypass Vulnerability

CVE-2026-41233 Overview

CVE-2026-41233 is an authorization bypass vulnerability in Froxlor, an open source server administration software. Prior to version 2.3.6, the Domains.add() function accepts the adminid parameter from user input without proper validation when the calling reseller does not have the customers_see_all permission. This flaw allows a malicious reseller to attribute newly created domains to any other admin, effectively bypassing their own domain quota and potentially exhausting another administrator's quota.

Critical Impact

Malicious resellers can bypass domain quotas and exhaust other administrators' quotas by manipulating the adminid parameter during domain creation.

Affected Products

• Froxlor versions prior to 2.3.6
• Froxlor server administration installations with multi-reseller configurations

Discovery Timeline

• 2026-04-23 - CVE-2026-41233 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41233

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), representing a critical flaw in the access control mechanism within Froxlor's domain management functionality. The root issue lies in the Domains.add() function, which fails to properly validate the adminid parameter when processing requests from resellers who lack the customers_see_all permission.

When a reseller creates a new domain, the system should automatically associate that domain with the reseller's own admin account and increment their domains_used counter accordingly. However, due to insufficient authorization checks, the function accepts an arbitrary adminid value supplied by the user. This allows an attacker to specify a different administrator's ID, causing the domain to be attributed to the wrong account.

The exploitation scenario enables quota manipulation attacks where a reseller can create unlimited domains under their actual control while having those domains counted against other administrators' quotas. This can lead to denial of service conditions where legitimate administrators are unable to create new domains because their quotas appear exhausted.

Root Cause

The vulnerability stems from improper authorization validation in the Domains.add() function. When processing domain creation requests, the function accepts the adminid parameter directly from user input without verifying that the requesting reseller has the authority to create domains under the specified administrator account. The permission check for customers_see_all is intended to restrict reseller visibility, but the code path fails to enforce that resellers can only create domains attributed to their own admin account when this permission is absent.

Attack Vector

The attack is exploitable over the network by any authenticated user with reseller privileges who lacks the customers_see_all permission. The attacker crafts a domain creation request with a manipulated adminid parameter pointing to a target administrator's account. Since no validation occurs to confirm the reseller's authority over the specified admin ID, the request succeeds and the new domain is incorrectly attributed to the target admin.

This manipulation has two primary impacts: first, the attacker's own domain quota remains unchanged, allowing them to create domains beyond their allocated limit; second, the target administrator's domains_used counter is incremented, potentially exhausting their quota and preventing legitimate domain operations.

Technical details and the specific code changes can be found in the GitHub Security Advisory and the patch commit.

Detection Methods for CVE-2026-41233

Indicators of Compromise

• Unusual domain creation patterns where resellers create domains attributed to other administrators
• Rapid quota exhaustion for administrator accounts that are not actively creating domains
• Discrepancies between a reseller's actual domain ownership and their recorded quota usage
• Audit log entries showing domain creation requests with adminid values not matching the authenticated reseller

Detection Strategies

• Monitor Froxlor audit logs for domain creation events where the adminid parameter differs from the authenticated user's associated admin account
• Implement database queries to identify domains where the owning admin does not match expected ownership patterns based on reseller relationships
• Review API and web request logs for manipulation attempts in the Domains.add() endpoint

Monitoring Recommendations

• Enable verbose logging for all domain management operations in Froxlor
• Set up alerts for quota anomalies where administrators reach limits faster than expected based on their activity patterns
• Periodically audit domain ownership records against reseller account mappings to detect unauthorized attributions

How to Mitigate CVE-2026-41233

Immediate Actions Required

• Upgrade Froxlor to version 2.3.6 or later immediately
• Audit existing domain records to identify any domains that may have been created with manipulated adminid values
• Review and correct quota counters for any affected administrator accounts
• Restrict reseller permissions to minimum necessary access until patching is complete

Patch Information

Froxlor version 2.3.6 addresses this vulnerability by implementing proper validation of the adminid parameter in the Domains.add() function. The fix ensures that resellers without customers_see_all permission can only create domains attributed to their own admin account. The patch is available via the official Froxlor 2.3.6 release, and technical details of the code changes can be reviewed in the commit bf47ba1.

Workarounds

• Temporarily revoke reseller access for untrusted accounts until the patch can be applied
• Implement web application firewall rules to filter requests to the domain creation endpoint that contain unexpected adminid values
• Enable strict audit logging and manual review of all domain creation operations as an interim detection measure

# Upgrade Froxlor to patched version
cd /var/www/froxlor
git fetch --tags
git checkout 2.3.6
php bin/froxlor-cli froxlor:update