CVE-2026-109963

Executive Summary

CVE-2026-109963 is an insecure direct object reference (IDOR) vulnerability in the Froxlor server management panel affecting versions before 2.3.14. The flaw resides in the email template editor (admin_templates.php), where the mail body is retrieved by mailbodyid without validating that the requesting reseller admin owns the referenced record. An authenticated reseller-level administrator can supply sequential foreign mailbodyid values alongside their own subjectid to read email templates belonging to other admins, including the full administrator account. The CVSS v3.1 base score is 4.3 (Medium), reflecting limited confidentiality impact, network attack vector, low privileges required, and no user interaction.

Technical Analysis

Froxlor is an open-source hosting control panel used to manage web space, email, DNS, and customer accounts. Its administrative interface is segmented by role, with a full administrator and lower-privileged reseller admins who manage a delegated subset of resources. The email template editor at admin_templates.php permits admins to define and customize subject and body content for system-generated emails.

The vulnerability is a classic direct object reference flaw (CWE-639, Authorization Bypass Through User-Controlled Key). According to the NVD description, the mail body is fetched using a mailbodyid parameter, but the application fails to perform an adminid ownership check to confirm that the record referenced by mailbodyid belongs to the requesting admin. Because the mail body lookup is keyed only on mailbodyid, any authenticated reseller admin can request arbitrary template bodies by iterating or guessing this identifier.

The subjectid parameter is referenced in the same request context, and the description explicitly notes that an attacker can pair "their own subjectid with sequential foreign mailbodyid values." This indicates the request handler accepts a subject identifier from the attacker's own scope while resolving the body from a separate, unvalidated identifier. Identifiers appear to be sequential (integers or otherwise enumerable), which removes the need for any guessing sophistication — an attacker simply increments the mailbodyid value.

The missing authorization check is the entire vulnerability: there is no injection, no memory corruption, and no authentication bypass. The attacker must already hold a valid, authenticated reseller-level session. What is violated is horizontal and vertical authorization — a low-privilege admin reads objects belonging to peers and to the higher-privileged full administrator.

No further code-level detail (function names beyond the referenced file, database schema, exact parameter types) is available in the provided description, and none is invented here.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the NVD description and the IDOR vulnerability class.

1. Reconnaissance / target identification. The attacker identifies a Froxlor instance running a version prior to 2.3.14 and obtains legitimate low-privilege credentials as a reseller admin. Login access to the panel is a precondition; no anonymous access is involved.

2. Triggering the flaw. From the email template editor (admin_templates.php), the attacker issues edit requests that reference a template body using the mailbodyid parameter. The handler does not verify that the referenced mail body belongs to the requesting admin (adminid ownership check absent). The attacker supplies their own subjectid to satisfy the editor's request flow while substituting a foreign mailbodyid.

3. Payload / execution method. Because mailbodyid values are sequential, the attacker enumerates them — for example by incrementing the value across repeated requests — extracting the response body returned for each identifier. No malformed input, encoding trick, or injection payload is required; the parameter is used exactly as designed, only with an out-of-scope value.

4. Post-exploitation impact. The attacker reads email templates owned by other reseller admins and by the full administrator. Email templates frequently contain branding, notification copy, and operational details; administrator templates may reveal business logic, infrastructure hints, or sensitive configuration embedded in template content. This is an information disclosure primitive, not code execution. The attacker gains no write access, no privilege escalation, and no direct persistence through this flaw alone. The disclosed content could, however, support lateral targeting, phishing realism, or reconnaissance for chained attacks.

The attack is low-complexity, requires no user interaction, and is remotely executable over the network (CVSS: AV:N/AC:L/PR:L/UI:N).

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Subscore interpretation:

• Attack Vector (Network): the panel is reachable over the network; exploitation requires no local presence.
• Attack Complexity (Low): sequential identifiers make enumeration trivial; no special conditions apply.
• Privileges Required (Low): a valid reseller admin account is needed, but not administrator rights.
• User Interaction (None): no victim action is needed.
• Scope (Unchanged): impact remains within the Froxlor application's security authority.
• Confidentiality (Low): a bounded but meaningful information disclosure — template content belonging to peers and the administrator.
• Integrity (None) / Availability (None): the flaw is read-only; no data modification or service disruption.

Business impact: Hosting providers and MSPs running Froxlor delegate reseller accounts to customers and partners. Any of those delegated accounts can silently harvest administrator email templates. Because templates shape outbound notifications, leaked administrator templates may expose internal messaging conventions, embedded links, and potentially sensitive operational text useful for social engineering. Blast radius is limited to the Froxlor instance and the confidentiality of template data; there is no cross-tenant code execution or data modification. The principal risk is insider-adjacent reconnaissance by a lower-trust reseller, which can precede phishing or further chained activity.

Detection Guidance

Sigma Rule

title: Froxlor Email Template IDOR - Foreign mailbodyid Access
id: 8f3c2a91-4d7e-4b12-9a6e-1c7f0e2b5d44
status: experimental
description: Detects authenticated requests to Froxlor admin_templates.php abusing sequential foreign mailbodyid values to read other admins' email templates (CVE-2026-109963).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109963
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-stem|endswith: 'admin_templates.php'
  selection_params:
    cs-uri-query|contains:
      - 'mailbodyid='
      - 'subjectid='
  filter_static:
    cs-uri-query|contains: 'action='
  condition: selection_uri and selection_params
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-query
falsepositives:
  - Legitimate template editing by administrators
  - Automated configuration management interacting with the template editor
level: medium
tags:
  - attack.t1190
  - cve.2026-109963

YARA Rule

rule CVE_2026_109963_Froxlor_Template_IDOR_Probe
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HTTP requests probing Froxlor admin_templates.php with mailbodyid/subjectid parameters (CVE-2026-109963)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109963"
        date = "2026-01-01"

    strings:
        $endpoint = "admin_templates.php" ascii nocase
        $mailbody = "mailbodyid=" ascii nocase
        $subject  = "subjectid=" ascii nocase

    condition:
        $endpoint and $mailbody and $subject
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109963 Froxlor Email Template IDOR Attempt"; flow:established,to_server; http.uri; content:"admin_templates.php"; http.uri; content:"mailbodyid="; http.uri; content:"subjectid="; classtype:attempted-recon; reference:cve,2026-109963; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109963; sid:2026109963; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where url.path endswith "admin_templates.php" and url.query : ("*mailbodyid=*" and "*subjectid=*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*admin_templates.php*" (uri_query="*mailbodyid=*" AND uri_query="*subjectid=*")
| rex field=uri_query "mailbodyid=(?<mailbodyid>\d+)"
| stats count min(_time) as first_seen max(_time) as last_seen dc(mailbodyid) as distinct_bodyids values(mailbodyid) as bodyids by src_ip
| where distinct_bodyids > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - distinct_bodyids

Wazuh OSSEC Rule

<group name="web,froxlor,idor,">
  <rule id="100963" level="10">
    <if_sid>31100</if_sid>
    <id>^311</id>
    <match>admin_templates.php</match>
    <match>mailbodyid=</match>
    <description>CVE-2026-109963: Possible Froxlor email template IDOR access using mailbodyid parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109963,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The CNA description names 2.3.14 as the fixed version, but no vendor advisory, commit, or security release reference has been independently confirmed in tracked sources. Treat the environment as unpatched until verified.

1. Immediate mitigations

   • Restrict reseller admin access strictly to trusted personnel; suspend or rotate credentials for dormant reseller accounts.
   • Apply application-layer authorization at a reverse proxy or WAF where feasible, flagging or blocking requests to admin_templates.php that combine subjectid and mailbodyid parameters outside normal editor flows.
   • Monitor web logs for repeated or sequential mailbodyid enumeration (see detection rules above) and alert on high counts of distinct identifiers per source IP.
   • Where reseller template editing is not operationally required, disable or restrict the template editor functionality via role configuration.

2. Patch / upgrade steps

   • Verify the current Froxlor version and upgrade to 2.3.14 or later, after independently confirming the fix via the official Froxlor release source or project repository.
   • Because no patch source is currently tracked, validate the fix in a staging instance before production rollout; confirm that an adminid ownership check is enforced for mailbodyid lookups.
   • Track the official Froxlor project channels for the security release announcement covering this CVE.

3. Long-term hardening

   • Enforce server-side ownership checks (an explicit adminid/tenant match) on every object reference resolved from user-supplied identifiers — treat IDOR prevention as a design requirement, not a per-endpoint patch.
   • Replace sequential, guessable identifiers with non-enumerable references where practical.
   • Adopt a role-minimization model so delegated resellers cannot reach administrator-scoped editing surfaces.
   • Integrate CVE monitoring and web-log anomaly detection into the SOC pipeline so future authorization bugs in panel software are caught behaviorally.

References

• NVD — CVE-2026-109963: https://nvd.nist.gov/vuln/detail/CVE-2026-109963
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Froxlor project / release information: https://froxlor.org
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns, exploit-in-the-wild activity, or public proof-of-concept are known for this CVE at the time of writing. CISA KEV status: not listed. EPSS: not yet scored by FIRST.org.