CVE-2026-121435

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.15

Description An authorization bypass allows authenticated customers to create MySQL databases by calling the 'Mysqls.add' API endpoint. This occurs because the endpoint lacks the customer hide options check, enabling users to create databases within their own quota even if the administrator has disabled the MySQL feature.

Recommendations Update to version 2.3.15 or later. As a temporary workaround, restrict access to the 'Mysqls.add' API endpoint.