CVE-2026-62988: Froxlor Information Disclosure Flaw

CVE-2026-62988 Overview

Froxlor is open source server administration software used to manage web hosting environments. CVE-2026-62988 affects Froxlor versions from 2.3.7 until 2.3.8, where several API commands return full database rows without stripping sensitive fields. The Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing endpoints leak password hashes and data_2fa values. An authenticated caller with permission to invoke these endpoints can retrieve password hashes for customer, administrator, and FTP accounts, plus Base32-encoded TOTP seeds for administrator and customer accounts. The issue is fixed in version 2.3.8 and is classified under CWE-200.

Critical Impact
Exposure of both password hashes and TOTP seeds enables offline hash cracking and generation of valid second-factor codes, defeating both authentication factors and enabling full hosting panel takeover.

Affected Products

Froxlor 2.3.7
Froxlor versions between 2.3.7 and 2.3.8
Fixed in Froxlor 2.3.8

Discovery Timeline

2026-08-18 - CVE-2026-62988 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-62988

Vulnerability Analysis

The vulnerability resides in three API command classes: lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php. Each of the get and listing handlers executes a database query and returns each row directly to the API response without filtering columns. The returned rows include the password column (containing password hashes) and the data_2fa column (containing Base32-encoded TOTP seeds for administrator and customer accounts). An authenticated API caller with permission to reach these endpoints receives this sensitive data in the response body. Password hashes can be cracked offline using standard tooling, while exposed TOTP seeds allow attackers to generate valid one-time codes until two-factor authentication is reset. Possession of both values defeats both authentication factors and permits takeover of the hosting panel and hosted resources.

Root Cause

The root cause is missing output sanitization on API responses. The affected handlers pass raw database rows into $this->response(...) without unsetting sensitive columns. There is no field allow-list on the query, and no post-fetch filtering removes credential material before serialization.

Attack Vector

The attack is performed over the network by an authenticated user holding permission to call the affected API endpoints. The attacker invokes Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, or Ftps.listing and reads the password and data_2fa fields from the JSON response.

php

// Security patch in lib/Froxlor/Api/Commands/Admins.php
// Unset sensitive data before returning API response
Database::pexecute($result_stmt, $query_fields, true, true);
$result = [];
while ($row = $result_stmt->fetch(PDO::FETCH_ASSOC)) {
    // unset sensitive data
    unset($row['password']);
    unset($row['data_2fa']);

    $result[] = $row;
}
return $this->response([
// Source: https://github.com/froxlor/froxlor/commit/52a43fb826bb9a058faf9c39feeef7ac4444ceba

php

// Follow-up patch preserving internal calls that require the fields
$result = Database::pexecute_first($result_stmt, $params, true, true);
if ($result) {
    if (!$this->isInternal()) {
        // unset sensitive data
        unset($result['password']);
        unset($result['data_2fa']);
    }
    $this->logger()->logAction(FroxlorLogger::ADM_ACTION, LOG_INFO, "[API] get admin '" . $result['loginname'] . "'");
    return $this->response($result);
}
// Source: https://github.com/froxlor/froxlor/commit/8667fa3a4d77d6e322b7b8f7b9edbc1613ab5797

Detection Methods for CVE-2026-62988

Indicators of Compromise

API responses from /api.php containing JSON fields named password or data_2fa for Customers.*, Admins.*, or Ftps.* commands.
Unusual volumes of Customers.listing, Admins.listing, or Ftps.listing calls from a single authenticated API key.
Successful admin or customer logins shortly after TOTP resets initiated from unfamiliar IP addresses.

Detection Strategies

Inspect web server and application logs for API command names Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing alongside unusually large response sizes.
Enable HTTP response inspection on egress paths to alert when JSON keys password or data_2fa appear in outbound Froxlor API traffic.
Correlate API key usage patterns to identify authenticated accounts enumerating administrator or customer records.

Monitoring Recommendations

Audit the Froxlor API access log daily and cross-reference API tokens with expected automation sources.
Alert on failed-then-successful authentication sequences that could indicate cracked hashes being reused.
Track TOTP reset events and second-factor enrollment changes as high-signal indicators after suspected exposure.

How to Mitigate CVE-2026-62988

Immediate Actions Required

Upgrade Froxlor to version 2.3.8 as documented in the GitHub Release v2.3.8.
Rotate all administrator, customer, and FTP passwords after upgrading, assuming exposure has occurred.
Reset two-factor authentication for every administrator and customer account to invalidate previously exposed TOTP seeds.
Revoke and reissue all Froxlor API keys and audit which accounts held permissions to the affected endpoints.

Patch Information

The fix is delivered in Froxlor 2.3.8. The primary patch in commit 52a43fb calls unset($row['password']) and unset($row['data_2fa']) on every returned row in Customers.php, Admins.php, and Ftps.php. A follow-up commit 8667fa3 preserves those fields only for internal calls guarded by $this->isInternal(). Refer to the GitHub Security Advisory GHSA-7788-ghfq-c6mh for the full advisory.

Workarounds

Restrict API access at the network layer to trusted IP addresses until the upgrade is applied.
Remove or reduce permissions for API users who do not require access to the affected Customers, Admins, or Ftps endpoints.
Place a reverse proxy in front of Froxlor that strips password and data_2fa keys from JSON responses to the affected endpoints as an interim control.

bash

# Upgrade Froxlor to the patched release
cd /var/www/froxlor
git fetch --tags
git checkout 2.3.8

# Force password reset and 2FA re-enrollment for all accounts after upgrade
mysql -u root -p froxlor -e "UPDATE panel_customers SET data_2fa='', type_2fa=0;"
mysql -u root -p froxlor -e "UPDATE panel_admins SET data_2fa='', type_2fa=0;"