Email Address Collision Vulnerability in Froxlor Package Leading to Account Takeover Risks
Summary
CVE-2025-29773: the vulnerability is that users (such as resellers or customers) are able to create accounts with the same email address as an existing account (e.g., if the admin has admin@froxlor.com, others can also create an account... Affects froxlor/froxlor versions < 2.2.6. Fixed in 2.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is an open-source server management panel that allows users to manage their web hosting services efficiently. It provides features such as account management, domain management, and resource allocation for resellers and customers. However, a critical vulnerability exists where multiple accounts can share the same email address, which can lead to security issues and account identification problems.
Vulnerability Detail
The vulnerability arises from Froxlor's lack of validation preventing multiple accounts from being created with the same email address. This flaw allows authenticated users, such as resellers or customers, to create accounts using an email address already associated with another account, including the admin account. The ramifications include potential privilege escalation and account takeover, as the system may confuse account ownership and permissions based on email identification.
How To Fix
Minimum fixed version
2.2.6
This is the first release that contains the fix.
composer require froxlor/froxlor:2.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users do not create accounts with email addresses that are already in use. Implement additional checks in your user registration process to validate email uniqueness before allowing account creation.
Conclusion
The Froxlor package has a significant vulnerability that allows multiple accounts to share the same email address, leading to potential security risks such as account takeover. It is crucial to update to the latest version to mitigate these risks and implement workarounds to enhance security until the update is applied.
See every vulnerability recorded for froxlor/froxlor →
FAQ
The vulnerability has a CVSS score of 5.8, indicating a moderate level of risk.
Authenticated users, such as resellers or customers, can exploit this vulnerability by creating accounts with existing email addresses.
The potential consequences include account takeover, privilege escalation, and confusion in account management due to email address collisions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
