Medium
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
Type: advisorySources: OSV
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-109963
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 23:38 UTC · Revision 1
Source evidence
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
core-osv · Original sourcePublished 13 Oct 2026, 13:27 UTC
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.
osv:CVE-2026-109963
Complete source record
{
"id": "c675953bd92d6b3ed88affe90f77be4f119ee7e97037ddfb24768c2c725e9f08",
"url": "https://osv.dev/vulnerability/CVE-2026-109963",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php",
"summary": "Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their own subjectid with sequential foreign mailbodyid values in edit requests to read other admins' email templates, including the full administrator's.",
"evidence": "osv:CVE-2026-109963",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-109963",
"aliases": [
"CVE-2026-109963",
"GHSA-646m-cj89-hm32"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/froxlor/froxlor",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c147de18d29dc00360557787d783fa6907ebd902"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.3.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.3.14"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"2.3.13",
"2.3.12",
"2.3.11",
"2.3.10",
"2.3.9",
"2.3.8",
"2.3.7",
"2.3.6",
"2.3.5",
"2.3.4",
"2.3.3",
"2.3.2",
"2.3.1",
"2.3.0",
"2.3.0-rc1",
"2.2.0-rc1",
"2.1.4",
"2.1.3",
"2.1.2",
"2.1.1",
"2.1.0",
"2.1.0-rc3",
"2.1.0-rc2",
"2.1.0-rc1",
"2.1.0-beta2",
"2.1.0-beta1",
"2.0.24",
"2.0.23",
"2.0.22",
"2.0.21",
"2.0.20",
"2.0.19",
"2.0.18",
"2.0.17",
"2.0.16",
"2.0.15",
"2.0.14",
"2.0.13",
"2.0.12",
"2.0.11",
"2.0.10",
"2.0.9",
"2.0.8",
"2.0.7",
"2.0.6",
"2.0.5",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"0.10.33",
"0.10.32",
"0.10.31",
"0.10.30",
"0.10.29.1",
"0.10.29",
"0.10.28",
"0.10.27",
"0.10.26",
"0.10.25",
"0.10.24",
"0.10.23.1",
"0.10.23",
"0.10.22",
"0.10.21",
"0.10.20",
"0.10.19",
"0.10.18",
"0.10.17",
"0.10.16",
"0.10.15",
"0.10.14",
"0.10.13",
"0.10.12",
"0.10.11",
"0.10.10",
"0.10.9",
"0.10.8",
"0.10.7",
"0.10.6",
"0.10.5",
"0.10.4",
"0.10.3",
"0.10.2",
"0.10.1",
"0.10.0",
"0.10.0-rc2",
"0.10.0-rc1",
"0.9.39.5",
"0.9.39.4",
"0.9.39.3",
"0.9.39.2",
"0.9.39.1",
"0.9.39",
"0.9.38.8",
"0.9.38.7",
"0.9.38.6",
"0.9.38.5",
"0.9.38.4",
"0.9.38.3",
"0.9.38.2",
"0.9.38.1",
"0.9.38",
"0.9.38-rc2",
"0.9.38-rc1",
"0.9.37",
"0.9.37-rc1",
"0.9.36",
"0.9.35.1",
"0.9.35",
"0.9.35-rc1",
"0.9.34.2",
"0.9.34.1",
"0.9.33-rc3",
"0.9.33-rc2",
"0.9.33-rc1",
"0.9.32",
"0.9.32-rc2",
"0.9.32-rc1",
"0.9.31-rc1",
"0.9.30",
"0.9.30-rc1",
"0.9.29",
"0.9.29-rc1",
"0.9.28.1",
"0.9.28",
"0.9.28-rc1",
"0.9.27",
"0.9.27-rc1",
"0.9.26",
"0.9.26-rc1",
"0.9.25",
"0.9.25-rc1",
"0.9.24",
"0.9.24-rc1",
"0.9.23",
"0.9.23-rc1",
"0.9.22",
"0.9.22-rc1",
"0.9.21",
"0.9.20.1",
"0.9.20",
"0.9.19",
"0.9.18.1",
"0.9.18"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109963.json"
}
}
],
"modified": "2026-10-28T02:30:40.623569126Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109963.json",
"https://github.com/froxlor/froxlor/security/advisories/GHSA-646m-cj89-hm32",
"https://nvd.nist.gov/vuln/detail/CVE-2026-109963",
"https://www.vulncheck.com/advisories/froxlor-before-2.3.14-idor-in-email-template-editor-via-admin-templates-php"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109963.json"
}
},
"related_cves": [
{
"value": "CVE-2026-109963",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508054,
"published_at": "2026-10-13T13:27:24.803+00:00"
}