EUVD-2026-115857
GHSA-7fmq-3hpx-jc23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Froxlor customer
-
ExploitCall Mysqls.add API endpoint
-
ExecutionBypass missing customer_hide_options check
-
ImpactCreate unauthorized MySQL database within quota
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid authenticated Froxlor customer account on the panel, and (2) the administrator having set panel.customer_hide_options to hide/disable the 'mysql' feature - if MySQL is not hidden there is no policy to bypass. The attacker invokes the Mysqls.add API endpoint, which omits the customer_hide_options authorization check enforced by get(), update(), and delete(). Limiting factors: no code execution or data access results; impact is confined to creating databases within the customer's own existing quota, so the blast radius is a single tenant and the practical harm is resource/policy violation only. |
| Impact | This is a low-to-moderate real-world risk and should be treated as a policy/hardening fix rather than an urgent emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network reach and low complexity but requires an existing authenticated customer account (PR:L), and the only impact metric set is VI:L - no confidentiality (VC:N) and no availability (VA:N) impact. The vulnerability is a missing authorization check (CWE-862): the Mysqls.add endpoint omits the customer_hide_options guard that get/update/delete enforce, so a customer can create MySQL databases even after an admin disables that feature. The vuln.today decision label is 'this_month' (not act_now/emergency), it is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was provided. The GHSA and VulnCheck entries are advisory references, not verified working exploit code. The signals are internally consistent: a genuine but bounded admin-policy-bypass whose worst outcome is unauthorized resource creation confined to the customer's own pre-existing quota, not a data breach or escalation beyond the tenant. |
| Exploit ScenarioDerived | A shared-hosting provider running Froxlor sets panel.customer_hide_options to disable the MySQL feature for a customer tenant, expecting the customer cannot provision databases. The authenticated customer instead calls the Mysqls.add API endpoint directly, which lacks the customer_hide_options check, and creates MySQL databases within their quota despite the disabling policy. No public working exploit is identified at time of analysis; exploitation is a straightforward direct API call documented in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Froxlor versions through 2.3.14 allow an authenticated customer to create MySQL databases through the Mysqls.add API endpoint even when the administrator has explicitly hidden or disabled the MySQL feature via panel.customer_hide_options, because add() omits the authorization check that get(), update(), and delete() enforce. The result is a policy violation rather than a breach: the customer provisions unauthorized databases only within their own existing quota, with no code execution or access to other tenants' data. This is a low-to-moderate real-world risk and should be treated as a policy/hardening fix rather than an urgent emergency; no public exploit code is confirmed in the available data, and exploitation requires both a valid customer account and the MySQL feature already being hidden.
RemediationAI
Upgrade Froxlor to 2.3.15 or later, which restores the missing authorization check in Mysqls::add() and enforces the customer_hide_options policy across all CRUD operations; the release is distributed through the project's Composer package composer/froxlor/froxlor and the normal Froxlor update channel, with details in advisory GHSA-6vjr-55fw-r5x2. If upgrading immediately is not possible, the actionable compensating control is to audit which customer accounts are trusted to hold database privileges and restrict customer-level API access to the Mysqls.add endpoint at the web server or reverse proxy layer, understanding that this blocks legitimate database creation for customers who are permitted to use MySQL; alternatively, administrators who have hidden MySQL but cannot patch should ensure databases are reviewed and cleaned up, accepting that detection is reactive. Disabling the MySQL feature in customer_hide_options does not mitigate the issue - it is precisely the configuration under which the bypass occurs - and no other workaround is described in the available sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Froxlor is a PHP-based server management panel built on a Symfony-style API command layer, where each resource has an Api/Commands class; MySQL database administration lives in lib/Froxlor/Api/Commands/Mysqls.php. The customer_hide_options panel setting (panel.customer_hide_options) is the administrator's mechanism for removing named features such as 'mysql' from the customer UI and API, and the codebase enforces it inconsistently: get() at line 285, update() at line 350, and delete() at line 539 all consult Settings::IsInList('panel.customer_hide_options', 'mysql') for non-admin callers, while add() beginning at line 69 performs only a quota check. The root cause is CWE-862 (Missing Authorization) - the add endpoint is reachable by any authenticated customer regardless of the hide policy, so the CRUD surface disagrees about whether the MySQL feature is permitted. The vulnerability is distinct from GHSA-q4rm-m6xh-5pv7, which concerns bypass of the mysql_server parameter, and it depends on configuration: it is exploitable only when the administrator has actually hidden 'mysql' in customer_hide_options and the attacker holds a valid customer panel account. The upstream fix, shipped in 2.3.15, adds an isAdmin()/Settings::IsInList guard to add() that throws an exception when a non-admin customer targets a hidden MySQL feature.
Know when Froxlor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated customer account required (PR:L) over the network API (AV:N/AC:L/UI:N); only unauthorized resource creation gives low integrity impact (I:L) with no C or A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8. Rated high severity (CVSS 8.8), this vulnerabilit
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20. Rated cr
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13. Rated critical severity
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. Rated critic
Command injection in Froxlor server admin before 2.3.4 due to typo (== instead of =) disabling input validation entirely
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. Rated high severity (CV
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14. Rated high severit
Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8),
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. Rated high severity (CVSS 8.8), this vulnerability
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. Rated high severity (CVSS 8.8), this vulnerability
An issue was discovered in Froxlor before 0.10.14. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
Froxlor is open source server administration software. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Exploit-DB