Missing Authorization in Froxlor - #VU162724
Published: November 9, 2026
Vulnerability identifier: #VU162724
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated customer to create MySQL databases in Froxlor despite an administrator explicitly disabling the MySQL feature for customers.
The vulnerability exists due to a missing authorization check for panel.customer_hide_options in the Mysqls.add API endpoint when MySQL access is disabled. An authenticated customer can call this endpoint directly to create unauthorized databases within their own quota.
Affected software
Froxlor
Remediation
Install security update from vendor's website.
Froxlor - update to 2.3.15