CVE-2026-121435

EUVD-2026-115857
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
froxlorfroxlor
𝑥
< 2.3.15
CNA
Common Weakness Enumeration
References
https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2
https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api