Is CVE-2026-121436 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121436?

CVE-2026-121436 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-121436

Description

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.