CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Attackers can bypass customer access controls to create MySQL databases and users on unauthorized servers via the Mysqls.add API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90935?
CVE-2026-90935 is a medium-severity missing authorization vulnerability in froxlor, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.
Weakness: CWE-285
Which versions are affected by CVE-2026-90935?
2 open source packages ship an affected version, including froxlor/froxlor.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.3.7 |
froxlor/froxlor Packagist | All versions | 2.3.7 |
How do I fix CVE-2026-90935?
Upgrade froxlor/froxlor to 2.3.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-90935 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90935 exists.
Sources
Also known as GHSA-q4rm-m6xh-5pv7, GHSA-w63q-47vh-4f98.