Authorization Bypass in Froxlor Allows Creation of Unauthorized MySQL Databases
CVE-2026-121435

5.3MEDIUM

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121435?

Froxlor prior to version 2.3.15 is susceptible to an authorization bypass that allows authenticated users to create MySQL databases via the Mysqls.add API endpoint. This endpoint does not correctly implement the required customer_hide_options check, enabling customers to initiate database creation even when the MySQL feature has been disabled by the administrator. Consequently, this can lead to the unauthorized creation of databases that violate intended restrictions, allowing users to exceed their defined quotas.

Affected Version(s)

froxlor 0 < 2.3.15

froxlor 2.3.15

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/froxlor-before-2.3.1...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.