Is CVE-2026-100712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100712 being exploited in the wild.

How severe is CVE-2026-100712?

Medium severity, with a CVSS score of 6.5, published 26 September 2026.

Is there a fix for CVE-2026-100712?

A patch was published on 2026-09-06: Fix released in version 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100712 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100712?

Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100712: froxlor two-factor authentication disable via CSRF GET request

CVE-2026-100712 · Severity: medium · CVSS 6.5 · Published 2026-09-26

froxlor is a web hosting control panel that allows administrators and customers to manage their accounts and services. An attacker can disable a logged-in user's two-factor authentication by tricking them into following a malicious link, reducing the account to password-only protection. If the attacker also obtains the victim's password, they gain full account takeover including the ability to mint API keys for persistent access.

Technologies: Froxlor. Vendors: Froxlor.

Quick answers

Is CVE-2026-100712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100712 being exploited in the wild.
How severe is CVE-2026-100712?: Medium severity, with a CVSS score of 6.5, published 26 September 2026.
Which products and versions are affected?: Froxlor through 2.3.10.
Is there a fix for CVE-2026-100712?: A patch was published on 2026-09-06: Fix released in version 2.3.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100712 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100712?: Check whether you run Froxlor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site request forgery (CSRF) affecting the 2FA management endpoint (2fa.php action=delete) which processes state-changing GET requests without CSRF token validation. The global CSRF middleware only guards POST/PUT/PATCH/DELETE methods, leaving GET mutations unprotected, and the session cookie is set to SameSite=Lax, allowing the victim's authenticated session to be carried in cross-site top-level navigation. Both customer and admin 2FA handlers are vulnerable; exploitation requires only luring an authenticated user to click a link, resulting in the immediate nullification of their TOTP enrollment.

Affected products

froxlor froxlor through 2.3.10

Timeline

2026-09-26: disclosed: Advisory published
2026-09-06: patched: Fix released in version 2.3.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.