CVE-2026-121435Medium· 4.3▾ SunlitFroxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
froxlor < 2.3.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121434Medium· 5.4Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
CVE-2026-113677Medium· 5.4Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
CVE-2026-121436High· 7.2Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
CVE-2026-113676Medium· 4.3Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
CVE-2026-113678Critical· 9.9Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
CVE-2026-109962Medium· 4.3Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands