CVE-2026-90935
Received Received - Intake

Froxlor MySQL Server Allowlist Bypass via mysql_server Parameter

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90935
EUVD
EUVD-2026-77453

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.3.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor before version 2.3.7 has a flaw in the Mysqls.add API command where it does not properly validate the mysql_server parameter against a customer's allowed server list. This allows attackers with API access to specify a disallowed server index and create MySQL databases and users on restricted servers, bypassing access controls designed to limit customer permissions.

Detection Guidance

Check Froxlor version with 'froxlor --version' or via the web interface. Inspect API logs for Mysqls.add requests with disallowed mysql_server parameters. Review database and user creation logs on MySQL servers to identify unauthorized actions.

Impact Analysis

If you are a Froxlor customer with API access, an attacker could exploit this to create databases on servers you are not authorized to use. This could lead to unauthorized resource consumption, policy bypass, and potential data integrity issues on those servers. While cross-tenant data exposure is limited, the attacker gains persistent access to the newly created databases through other API operations.

Compliance Impact

This vulnerability could lead to unauthorized access to databases on restricted servers, potentially violating data segregation and access control requirements in GDPR and HIPAA. It may result in non-compliance due to unauthorized resource usage and potential data integrity risks, though direct data exposure is limited.

Mitigation Strategies

Upgrade Froxlor to version 2.3.7 or later immediately. Review API access logs for suspicious Mysqls.add requests. Temporarily restrict API access for customers until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart