CVE-2026-121435 — Vulnerability intelligence
—
Published:
- CVSS
- 5.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.