CVE-2026-90935: Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs customer-level privileges sufficient to invoke the Mysqls.add API command. The issue is remotely reachable and does not require user interaction.
What access can an attacker gain through the bypass?
They can provide a MySQL server index that is not in their allowed_mysqlserver allowlist, then create MySQL databases and users on servers that should be forbidden to that customer.
Which deployments are affected?
Froxlor versions before 2.3.7 are affected. The provided data does not indicate whether any particular default customer configuration grants access to the vulnerable API command.
How can I determine whether this has been exploited?
Review Mysqls.add API activity and MySQL database or user creation records for customer accounts. Look for creations assigned to MySQL server indexes outside the requesting customer's allowed_mysqlserver allowlist.