CVE-2023-50256 is an input validation flaw in Froxlor, the open source server administration software. Before version 2.1.2 the registration form could be submitted with required fields left blank. NVD rates it High (7.5), while the project advisory says Moderate. Upgrade to Froxlor 2.1.2 or later.
What's affected
Product: Froxlor, open source server administration software. Fixed: version 2.1.2. The NVD description says the problem exists prior to 2.1.2, while the GitHub advisory lists the affected version as 2.1.1 only. Treat anything older than 2.1.2 as affected until you have checked, since the advisory's single version may simply reflect the release the reporter tested.
Severity differs between sources. The NVD record scores it 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, an integrity impact only. The Froxlor advisory, GHSA-625g-fm5w-w7w4, labels it Moderate. Both are fair readings of a logic flaw whose real impact depends on how you run the panel. The advisory was published on 3 January 2024, and the record the same day.
The advisory describes a business logic error found during a penetration test: the registration form accepted blank values for username and password, and for surname and company name, which the system is meant to require.
How to check if you're exposed
Find the Froxlor version in the admin interface, usually in the footer or on the system overview page, and compare it with 2.1.2.
If you installed from a package or from a release archive, you can also look at the version string in the files on disk or at your package manager's record. Which one applies depends on how you installed it, so I will not give a command that might not match your setup.
Next, check whether the registration form is actually enabled. Hosting panels often keep self registration switched off, which would reduce the practical exposure a good deal. If it is on, look at your customer list for entries with empty or odd names that you did not create.
What to do now
- Upgrade Froxlor to 2.1.2 or later, following the project's upgrade notes.
- If you do not need public self registration, turn it off in the settings.
- Review recent customer or user records for blank or incomplete entries and remove ones that should not exist.
- Add server side checks on any custom registration flow you run in front of Froxlor, so required fields are enforced outside the browser.
- Record the version in your inventory so the next advisory is quick to match.
Why it matters
The record maps this to CWE-20, improper input validation. The form is meant to enforce that certain fields are filled in, but the server accepted submissions where they were empty. The essential point is that required field checks must run on the server, because anything enforced only in the browser can be skipped by a person who sends the request directly.
The impact is not remote code execution, and the record says so with an integrity only vector. What blank values can do depends on how the rest of the application treats accounts without names or credentials. Accounts that exist in a half valid state can slip past later checks, which is the usual reason this class gets a score at all.
KEV is false and I found no claim of exploitation. This is a small fix with a modest risk, which makes it a good example of why a patch workflow should handle ordinary severity items as routinely as critical ones.
Try it yourself
When a fixed version exists, the quickest win is knowing exactly where you run the old one. The demo below shows that workflow.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Froxlor 2.1.2, according to both the NVD description and the project advisory.
Why do the sources disagree on severity?
NVD scores a network reachable integrity impact at 7.5 High. The project rates the practical risk as Moderate. Both agree on the flaw and the fix.
Sources
Last reviewed: 19 October 2026.
