CVE-2025-29773: 
PHP vulnerability analysis and mitigation

Froxlor, an open-source server administration software, contains a vulnerability (CVE-2025-29773) in versions prior to 2.2.6 that allows authenticated users to create accounts using email addresses that are already associated with existing accounts. This vulnerability was discovered and disclosed on March 13, 2025 (NVD, GitHub Advisory).

The vulnerability stems from insufficient email address validation during account creation. Authenticated users with reseller or customer privileges can register new accounts using email addresses that are already in use by other accounts, including administrative accounts. The CVSS v3.1 base score is 5.8 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N. The vulnerability is classified as CWE-287 (Improper Authentication) (GitHub Advisory).

The vulnerability creates potential issues with account identification and security. It allows authenticated users to create accounts with duplicate email addresses, which could lead to confusion in account management and potential security risks, particularly when the duplicated email address belongs to an administrative account (NVD).

The vulnerability requires authentication and can be exploited by users with reseller or customer privileges. A proof-of-concept demonstration has been created and is available, showing the exploitation process (GitHub Advisory).

The vulnerability has been fixed in Froxlor version 2.2.6. Users are advised to upgrade to this version to prevent the creation of accounts with duplicate email addresses (GitHub Advisory).