CVE-2026-121435 Details
Description
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
An authorization bypass vulnerability has been identified in Froxlor versions prior to 2.3.15. This vulnerability allows authenticated customers to create MySQL databases by using the Mysqls.add API endpoint, which does not include the necessary customer_hide_options authorization check. As a result, customers can bypass admin restrictions and create unauthorized databases within their allocated quota, even when the MySQL feature has been disabled by the admin.
Users can update to Froxlor version 2.3.15 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.14 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |