{"id":"CVE-2026-121435","published":"2026-11-03T15:17:34.783","lastModified":"2026-11-03T15:17:34.910","description":"Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2","tags":[]},{"url":"https://www.vulncheck.com/advisories/froxlor-before-2.3.15-authorization-bypass-via-mysqls-add-api","tags":[]}],"exploitRefs":[{"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-6vjr-55fw-r5x2","tags":[]}],"hasPoc":true,"ai":null}