Live › vulnerability › CVE-2026-121435
Froxlor, a web hosting control panel, lets authenticated customers call the Mysqls.add API even when the administrator has disabled MySQL for them. An attacker with a customer account can create databases within their quota, bypassing the hosting policy.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Hosting providers and organisations running a self-hosted Froxlor panel where customers have accounts. Exposure depends on the admin having disabled MySQL for customers, which is the policy this bypasses. Installations without customer accounts can skip it.
No product ranges from the sources yet.
froxlor/lib/version.php in the install directory2.3.15 or later (the advisory states the fix is in versions before 2.3.15 being affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
This page as .md · .json · in your agent: get_signal("CVE-2026-121435")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.