Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-90935

Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

froxlor froxlor

Default version status: unaffected

  • 0 to < 2.3.7affected
  • 2.3.7unaffected
pkg:composer/froxlor/froxlor

References