{"apiVersion":"1.0","identifier":"CVE-2026-55593","description":"Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator-s browser to submit a forged request that adds an attacker-controlled address to an API key-s allowed_from list or removes its expiration, weakening the key-s security restrictions. This issue is fixed in version 2.3.8.","publishedAt":"2026-08-18T21:16:36","lastModifiedAt":"2026-08-19T19:17:20","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55593","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","epssProbability":0.00232,"riskScore":0.66,"affectedProduct":"Froxlor","affectedVersions":"<2.3.8","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55593","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55593","en":"https://www.redsauce.net/en/cves/CVE-2026-55593","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55593","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55593","de":"https://www.redsauce.net/de/cves/CVE-2026-55593","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55593","el":"https://www.redsauce.net/el/cves/CVE-2026-55593"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55593"}}