CVE-2026-121434

The record

Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation.

Affected packages

Related vulnerabilities

• CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability… CWE-862
• CVE-2026-121730 emailflare before commit cf31f33 contains a missing authorization vulnerability in POST… CWE-862
• CVE-2026-121729 emailflare before commit cf31f33 contains a missing authorization vulnerability in the… CWE-862
• CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. CWE-862
• CVE-2026-121253 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
• CVE-2026-121251 Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-862
• CVE-2026-121194 Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
• CVE-2026-121199 Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38… CWE-862