CVE-2026-113677 froxlor CVE debrief

Who should care

Defenders managing Froxlor installations, particularly those with reseller setups, should assess exposure and verify versions to prevent unauthorized domain deletions. Additionally, operators, platforms, and security teams impacted by this vulnerability should prioritize verifying Froxlor versions and restricting access to the SubDomains.delete API.

Why it matters

CVE-2026-113677 is a medium-severity vulnerability in Froxlor that allows authenticated customers to delete reseller-provisioned main domains, potentially leading to unauthorized domain deletions and manipulation of subdomain allowances. Defenders should prioritize verifying Froxlor versions and restricting access to the SubDomains.delete API.

• Potential for unauthorized domain deletions
• Orphaning of vhost, DNS, and subdomain records
• Manipulation of subdomain allowances
• Potential for lateral movement via subdomain exploitation

Technical summary

The vulnerability exists in the SubDomains.delete API command of Froxlor, allowing authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. This can lead to orphaned vhost, DNS, and subdomain records, and manipulation of subdomain allowances. The vulnerability can be mitigated by verifying Froxlor versions and restricting access to the SubDomains.delete API. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Defenders should prioritize verifying Froxlor versions and restricting access to the SubDomains.delete API to prevent unauthorized domain deletions.

Recommended defensive actions

• Verify Froxlor version and apply patch 2.3.15 if vulnerable
• Restrict access to SubDomains.delete API
• Monitor for unauthorized domain deletions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patches. The vulnerability exists in the SubDomains.delete API command of Froxlor, allowing authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. This can lead to orphaned vhost, DNS, and subdomain records, and manipulation of subdomain allowances. Defenders should prioritize verifying Froxlor versions and restricting access to the SubD

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.