CVE-2026-109962: Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.14
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Authenticated reseller accounts can exploit it. They can invoke the affected API read commands through api.php without full administrator privileges.
What information can be exposed?
The affected API methods can disclose MySQL server and cronjob configuration intended for full administrators, including management usernames, hosts, ports, TLS settings, and cron metadata.
Which API methods should be reviewed or restricted?
Review access to MysqlServer.listing, MysqlServer.get, and Cronjobs.listing through api.php. These are the commands identified as exposing the restricted configuration to reseller accounts.
What versions are affected?
Froxlor versions from 0.10.0 before 2.3.14 are affected. Updating to 2.3.14 or later removes the affected version range.