CVE-2026-41233: 
PHP vulnerability analysis and mitigation

CVE-2026-41233 is an authorization bypass vulnerability in Froxlor, an open-source server administration panel, affecting all versions prior to 2.3.6. In the Domains.add() API function, the adminid parameter is accepted from user input without validation when the calling reseller lacks the customers_see_all permission, allowing a reseller to attribute newly created domains to any other admin account. The vulnerability was published on April 23, 2026, with a patch released in version 2.3.6. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Froxlor Release).

The root cause is Incorrect Authorization (CWE-863) in lib/Froxlor/Api/Commands/Domains.php. The add() method reads adminid from user-supplied input at line 327 ($adminid = intval($this->getParam('adminid', true, $this->getUserDetail('adminid')))), but the validation block that checks whether the specified admin can accept more domains only executes when customers_see_all == '1' (lines 410–421). For resellers without this permission — the common case — there is no else branch to force $adminid back to the caller's own ID, so the unvalidated value flows directly into the domain INSERT statement and the domains_used quota increment UPDATE. The initial quota check at line 321 evaluates the caller's own domains_used, which is never incremented (the target admin's counter is incremented instead), allowing the check to pass indefinitely. The fix, committed in bf47ba1, adds an else branch that forces $adminid = intval($this->getUserDetail('adminid')) when the caller lacks customers_see_all (GitHub Advisory, Patch Commit).

A reseller with valid API credentials can create an unlimited number of domains beyond their allocated quota, since their own domains_used counter is never incremented. Simultaneously, the targeted admin's domains_used counter is incremented with each request, potentially exhausting that admin's quota and preventing legitimate domain creation — constituting a denial-of-service against the target admin's resource allocation. Additionally, domains created this way are associated with an admin who does not own the customer, breaking the ownership model and causing them to become invisible to the reseller in domain listings, while remaining active on the server and corrupting resource usage reporting and billing (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of detailed curl commands with specific parameters and expected database state changes demonstrating exploitation against a real Froxlor installation (GitHub Advisory). Exploitation requires only low privileges (valid reseller API credentials) and no user interaction, making it straightforward for any authenticated reseller to abuse. The EPSS score is approximately 0.034%, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of publication. No threat actor attribution has been reported.

1. Obtain reseller credentials: Acquire valid API credentials (API key and secret) for a reseller account that does NOT have the customers_see_all permission on the target Froxlor instance.
2. Identify a valid customer ID: Determine the customerid of one of the reseller's own customers (required by the getCustomerData() call, which correctly restricts customers to the reseller's own).
3. Identify the target admin ID: Determine the adminid of the admin whose quota you wish to exhaust (e.g., adminid=1 for the super-admin).
4. Send a crafted API request: POST a Domains.add command to the Froxlor API endpoint, specifying the target admin's ID in the adminid parameter:

   curl -s -u RESELLER_API_KEY:RESELLER_API_SECRET -X POST https://froxlor.example/api.php \
     -d '{"command": "Domains.add", "params": {"domain": "bypass-test-1.com", "customerid": 3, "adminid": 1}}'

5. Verify exploitation: Confirm in the database that the domain was created with adminid=1, the reseller's domains_used was not incremented, and the target admin's domains_used was incremented.
6. Repeat indefinitely: Continue sending requests with different domain names — the reseller's quota check always passes since their own counter never changes, allowing unlimited domain creation and progressive exhaustion of the target admin's quota (GitHub Advisory).

• Network: Repeated POST requests to the Froxlor API endpoint (/api.php) from a reseller account with "command": "Domains.add" payloads containing an adminid value different from the reseller's own admin ID.
• Logs: Froxlor API access logs showing a single reseller account creating a high volume of domains in a short time period; domain creation events attributed to an admin ID that does not match the reseller's assigned admin.
• Database: Rows in panel_domains where adminid does not correspond to the customer's assigned reseller; rapid or unexpected increases in domains_used for an admin account without corresponding legitimate activity; domains_used for a reseller account remaining static despite active domain creation.
• Application Behavior: Domains appearing in the server configuration but not visible in the reseller's domain listing (due to adminid mismatch filtering); target admin receiving quota-exceeded errors for domain creation despite not having created the domains themselves (GitHub Advisory).

Upgrade Froxlor to version 2.3.6 or later, which adds an else branch in Domains.add() to force $adminid to the caller's own admin ID when the reseller lacks customers_see_all permission (Froxlor Release, Patch Commit). As a temporary workaround prior to patching, administrators should restrict reseller API access and monitor domain creation activities for unauthorized admin assignments. Reviewing the panel_domains table for adminid mismatches can help identify any domains already created through this bypass.

The vulnerability was disclosed via a GitHub Security Advisory by the Froxlor maintainer (d00p/Michael Kaufmann) on April 15, 2026, and patched in the same security release (2.3.6) that addressed several other security issues including path traversal, SQL escaping, and DNS record validation (Froxlor Release). A brief write-up was published on infinitsec.net shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been observed.