Authorization Bypass in Froxlor Web Hosting Management Panel
CVE-2026-90935

5.3MEDIUM

Key Information:

Vendor

Froxlor

Status
Froxlor
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90935?

Froxlor prior to version 2.3.7 contains a significant vulnerability in its Mysqls.add API command, which improperly validates the mysql_server parameter against an allowed MySQL server allowlist for users. This flaw allows attackers to bypass access restrictions, permitting them to create MySQL databases and user accounts on unauthorized servers. Consequently, this could enable unauthorized access to sensitive data and configurations, posing a serious security risk to web hosting environments.

Affected Version(s)

froxlor 0 < 2.3.7

froxlor 2.3.7

References

https://github.com/froxlor/froxlor/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/froxlor-before-2.3.7...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

offset
.