CVE-2026-109962

Name of the Vulnerable Software and Affected Versions Froxlor versions 0.10.0 through 2.3.13

Description Missing authorization allows reseller accounts to access MySQL server and cronjob configurations intended only for full administrators. This is achieved by using API read commands through the 'api.php' endpoint. Specifically, resellers can call the functions MysqlServer.listing(), MysqlServer.get(), or Cronjobs.listing() to retrieve sensitive data, including management usernames, hosts, ports, TLS settings, and cron metadata.

Recommendations Update Froxlor to version 2.3.14 or later.