MEDIUM 5.3 NVD
CVE-2026-121435
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
References
- https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2
- https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.