CVE-2026-121435
Deferred Deferred - Pending Action

Froxlor Authorization Bypass via MySQL Database Creation

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121435
EUVD
EUVD-2026-115857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor before version 2.3.15 has an authorization bypass flaw. Authenticated customers can exploit the Mysqls.add API endpoint to create MySQL databases even when the admin has disabled the MySQL feature. This happens because the endpoint lacks a customer_hide_options check, allowing unauthorized database creation within customer quotas.

Detection Guidance

Check Froxlor logs for unauthorized MySQL database creation attempts via the Mysqls.add API endpoint. Look for POST requests to /api.php?action=Mysqls.add without proper admin approval.

Impact Analysis

This vulnerability allows authenticated users to bypass admin-imposed restrictions and create databases against policy. It could lead to resource misuse, unexpected database usage, or potential data integrity issues if quotas are exceeded or unauthorized databases are created.

Mitigation Strategies

Upgrade Froxlor to version 2.3.15 or later to patch the authorization bypass. Review existing MySQL databases for unauthorized entries and remove any created without admin approval.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...