# CVE-2018-12642: froxlor β€” Fixed in 0.9.40 🐘 🐘 Packagist Not in CISA KEV HIGH severity # CVE-2018-12642 β€” froxlor HIGH [Fix: Froxlor/Froxlor@aa88156](https://github.com/Froxlor/Froxlor/commit/aa881560cc996c38cbf8c20ee62854e27f72c73c) CVE-2018-12642 is a high-severity (CVSS 7.5) CWE-732 vulnerability in froxlor/froxlor. A fix is available for froxlor/froxlor β€” see the affected versions and patch details below. Froxlor Incorrect Access Control Also known as[GHSA-r6g8-mq9v-cgp4](/vulnerability/GHSA-r6g8-mq9v-cgp4) Published Jun 22, 2018 Updated Oct 20, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Oct 23, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 1.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs72th percentile β€” riskier than 72% of all scored CVEsHighest risk 0.00%0.63%1.27%1.90%0.3%1.4%Apr 26Aug 26Oct 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐘`froxlor/froxlor` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages β€” download data is not available via public APIs for these ecosystems. ## Description Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `froxlor/froxlor` all versions 0.9.40`composer require froxlor/froxlor:^0.9.40` ## Affected Products 1 product Β· 1 configurations Application `froxlor`froxlor ≀ 0.9.39.5 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for froxlor/froxlor, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update froxlor/froxlor to 0.9.40 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2018-12642 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. O3 Security Β· Impact-Aware SCA ### Is CVE-2018-12642 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)