{"affected":[{"defaultStatus":"unaffected","product":"froxlor","source":"CNA: VulnCheck","vendor":"froxlor","versions":[{"lessThan":"2.3.15","status":"affected","version":"2.3.0","versionType":"semver"},{"status":"unaffected","version":"2.3.15","versionType":"semver"}]}],"cveId":"CVE-2026-121434","cwes":["CWE-862"],"description":"Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"}],"modifiedAt":1793716107125,"publishedAt":1793716107125,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-ch7m-649m-x7xg"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/froxlor-2.3.0-before-2.3.15-authorization-bypass-via-certificates-update-api"}],"remediation":[],"revision":"334d3475673cbe66b973121a77225982a6dba35c7c0787aaf4e6d5f2d0f53911","sources":[{"modifiedAt":1793716107125,"name":"CNA: VulnCheck","retrievedAt":1793718585950,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121434"}],"ssvc":null,"status":"published","title":"Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API","updatedAt":1793718585950}