CVE-2026-121435

MEDIUM 4.3

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.

CWE	CWE-862
Vendor	froxlor
Product	froxlor
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new medium vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

froxlor / froxlor

0 < 2.3.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2 vulncheck.com: https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api

Credits

🔍 manus-use