CVE-2026-41233

CVE-2026-41233 is an input validation flaw in Froxlor server administration software versions prior to 2.3.6. The vulnerability exists in the Domains.add() function, where the adminid parameter is accepted from user input without proper validation when a reseller lacks the customers_see_all permission. This flaw allows a reseller to arbitrarily assign newly created domains to other administrators, enabling quota bypass and potential denial-of-service through quota exhaustion of competing administrators. The vulnerability presents medium severity with a CVSS score of 5.4. It requires low attack complexity and authenticated user privileges to exploit, but poses limited confidentiality impact while enabling integrity and availability violations through unauthorized quota manipulation. The attack is conducted over the network without requiring user interaction. This vulnerability shows minimal exploitation activity and community attention. It is not listed on CISA's Known Exploited Vulnerabilities catalog, has no publicly available exploit code in circulation, and demonstrates negligible EPSS prevalence metrics. The inactive status on security hot lists suggests limited real-world targeting, though organizations running affected Froxlor versions should still apply the version 2.3.6 patch as a standard security measure to prevent potential abuse by malicious reseller accounts.