CVE-2026-121434: froxlor, заобикаляне на вход и права

Описание

Оригинално описание

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.

Засегнати продукти

• froxlor froxlor: 2.3.0 преди 2.3.15; 2.3.15

Вид слабост

• CWE-862 Missing Authorization

История

Други уязвимости в froxlor froxlor

• 8.6CVE-2026-121436
• 5.3CVE-2026-121435
• 9.9CVE-2026-113678
• 5.3CVE-2026-113676
• 5.4CVE-2026-113677

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-121434
• https://nvd.nist.gov/vuln/detail/CVE-2026-121434
• https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg
• https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api