CVE-2026-55593 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
An attacker can trick an administrator into modifying API key restrictions via a forged request, bypassing security controls in Froxlor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55593?
CVE-2026-55593 is a medium-severity vulnerability in froxlor, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8.
Weakness: CWE-352
Which versions are affected by CVE-2026-55593?
2 open source packages ship an affected version, including froxlor/froxlor.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.3.8 |
froxlor/froxlor Packagist | All versions | 2.3.8 |
How do I fix CVE-2026-55593?
Upgrade froxlor/froxlor to 2.3.8 or later.
Is CVE-2026-55593 being exploited?
There is no known exploitation of CVE-2026-55593 in the wild and no public exploit code.
Sources
Also known as GHSA-xpr4-8vp6-c87j.