Description
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| froxlor | froxlor | 0.10.0 – < 2.3.14 | 2.3.14 |
Advisories 1
- WID-SEC-2026-3629 Froxlor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
References
- GitHub Security Advisory (GHSA-mx7x-72gh-8j8f) vendor-advisory
- VulnCheck Advisory: Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API third-party-advisory