Missing Authorization Vulnerability in Froxlor Web Hosting Control Panel

CVE-2026-109962

What is CVE-2026-109962?

Froxlor versions prior to 2.3.14 are susceptible to a missing authorization vulnerability, which permits reseller accounts to access sensitive MySQL server and cronjob configurations through unauthorized API commands. This security flaw allows unauthorized resellers to retrieve critical data including management usernames, hosts, ports, TLS settings, and metadata related to cron jobs via calls to MysqlServer.listing, MysqlServer.get, or Cronjobs.listing endpoints in api.php. Such access can lead to significant security risks and potential data exposure.

References