CVE-2026-55593 froxlor CVE debrief

Who should care

Administrators of Froxlor installations, security teams responsible for server administration software, and developers of Froxlor should assess exposure and prioritize verification of their systems.

Why it matters

CVE-2026-55593 is a vulnerability in Froxlor that allows unauthenticated attackers to weaken API key security restrictions, potentially leading to unauthorized access and data breaches. Administrators of Froxlor installations should assess exposure and prioritize verification of their systems.

• Weakened API key security restrictions may allow unauthorized access
• Potential for lateral movement within the network
• Need for verification of Froxlor installation version and API key configurations
• Possible data breaches or unauthorized modifications

Technical summary

The vulnerability is caused by the lack of CSRF token validation in the editapikey action of the Ajax::editApiKey class. This allows an unauthenticated attacker to submit a forged request that modifies the allowed_from list or expiration of an API key. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security

Defensive priority

Administrators of Froxlor installations should assess exposure and prioritize verification of their systems.

Recommended defensive actions

• Verify Froxlor installation version and upgrade to 2.3.8 if necessary.
• Review API keys and their allowed_from lists for any suspicious entries.
• Monitor for unusual activity related to API key usage.
• Perform a thorough review of the Froxlor installation and API key configurations.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Administrators should verify Froxlor installation version and API key configurations. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token. The vulnerability allows an unauthenticated attacker to induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration. This is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.