Froxlor CVE-2026-109962

Exploitation requires an authenticated reseller-level account (PR:L) on a multi-tenant Froxlor instance running a vulnerable version (0.10.0 up to but not including 2.3.14), with API access via api.php enabled. The attacker specifically invokes the MysqlServer.listing, MysqlServer.get, or Cronjobs.listing API read commands, which omit the admin-only authorization check. Limiting factors: no external unauthenticated path exists, the operator must have provisioned reseller accounts (single-admin installs are not exposed), impact is read-only disclosure of MySQL server and cron configuration metadata with no write or code-execution capability, and no user interaction is involved.

This is a genuine but modest-severity information-disclosure issue, not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) correctly frames it as a low-impact confidentiality-only flaw: it is network-reachable with low attack complexity, but requires existing low-level privileges (PR:L - a valid reseller account), has no integrity or availability impact, and no scope change. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced, so there is no signal of active or probable widespread exploitation. The realistic threat is a privilege/authorization boundary violation by an already-provisioned reseller rather than an external unauthenticated attacker. The signals are internally consistent (authenticated low-privilege actor, limited confidentiality impact) with no contradictions to flag. Because exploitation requires a legitimate reseller account on a multi-tenant Froxlor instance, this is primarily a concern for shared-hosting operators who delegate reseller access to untrusted or semi-trusted parties; single-admin deployments are effectively unaffected.

A hosting provider grants a reseller account to a customer on a shared Froxlor control panel. That reseller authenticates to api.php and issues MysqlServer.listing/MysqlServer.get or Cronjobs.listing calls that lack an authorization check, receiving admin-only MySQL management usernames, hosts, ports, and TLS settings plus cron metadata they should never see. No public proof-of-concept is referenced in the provided data.