CVE-2026-121436
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 03, 2026
Vendor
unknown
Description
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.