CVE-2026-109962: Froxlor Missing Authorization Vulnerability

CVE-2026-109962 Overview

CVE-2026-109962 is a missing authorization vulnerability in Froxlor, an open-source server management panel. The flaw affects Froxlor versions 0.10.0 through versions prior to 2.3.14. Reseller accounts can invoke API endpoints that are intended to be restricted to full administrators. Specifically, calls to MysqlServer.listing, MysqlServer.get, and Cronjobs.listing via api.php return MySQL server management credentials and cronjob configuration metadata. The exposed data includes management usernames, host addresses, ports, TLS settings, and cron metadata. The weakness is tracked as CWE-285: Improper Authorization.

Critical Impact
Authenticated reseller accounts can read full-admin-only MySQL server configuration and cronjob metadata, exposing database management credentials and infrastructure details.

Affected Products

Froxlor 0.10.0 and later
Froxlor versions prior to 2.3.14
Froxlor API endpoints: MysqlServer.listing, MysqlServer.get, and Cronjobs.listing

Discovery Timeline

2026-10-13 - CVE-2026-109962 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109962

Vulnerability Analysis

Froxlor exposes administrative functions through api.php, which dispatches requests to module methods such as MysqlServer.listing and Cronjobs.listing. These endpoints are documented as full-admin-only operations. The affected versions fail to enforce the admin-only authorization check when the caller is a reseller account. A reseller authenticates to the API using their standard credentials and issues read commands that return data they should not access.

The disclosed MySQL metadata includes management usernames, host, port, and TLS configuration. Cronjob listings reveal scheduled task metadata that describes internal operations. This information supports lateral movement, credential targeting, and reconnaissance against the hosting infrastructure.

Root Cause

The root cause is a missing authorization check in the API handlers for MysqlServer and Cronjobs read operations. The code validates that the caller is authenticated but does not verify that the account holds the administrator role required for these endpoints. Resellers inherit API access by design, and the absence of a role gate causes the privilege boundary between resellers and administrators to collapse for these specific calls.

Attack Vector

Exploitation requires valid reseller credentials and network access to the Froxlor api.php endpoint. The attacker authenticates as a reseller and submits a JSON request specifying the MysqlServer.listing, MysqlServer.get, or Cronjobs.listing command. The response returns the restricted configuration data. No user interaction is required, and the attack is executable over the network against any reachable Froxlor instance in the affected version range. Technical details are available in the GitHub Security Advisory GHSA-mx7x-72gh-8j8f and the VulnCheck Advisory on Froxlor.

Detection Methods for CVE-2026-109962

Indicators of Compromise

API requests to api.php invoking MysqlServer.listing, MysqlServer.get, or Cronjobs.listing where the authenticated principal is a reseller rather than an administrator.
Reseller session identifiers appearing in web server access logs correlated with POST requests to api.php returning non-trivial response sizes.
Unexpected outbound connections to MySQL management hosts originating from systems associated with reseller accounts.

Detection Strategies

Parse Froxlor web server access logs for api.php requests and correlate the request body command field with the authenticated user role.
Alert on any reseller-authenticated API call that targets the MysqlServer or Cronjobs modules.
Review application logs for successful admin-only operations executed under non-admin session contexts.

Monitoring Recommendations

Enable verbose API audit logging in Froxlor and forward logs to a centralized logging platform for role-based correlation.
Monitor for subsequent authentication attempts against MySQL management interfaces from untrusted sources after suspected disclosure events.
Track the installed Froxlor version across hosting environments and alert when instances remain below 2.3.14.

How to Mitigate CVE-2026-109962

Immediate Actions Required

Upgrade Froxlor to version 2.3.14 or later on all affected installations.
Audit reseller account activity in web and API logs for calls targeting MysqlServer or Cronjobs endpoints prior to patching.
Rotate MySQL management credentials if logs indicate reseller access to the affected endpoints.

Patch Information

The fix is available in Froxlor 2.3.14. Refer to the GitHub Security Advisory GHSA-mx7x-72gh-8j8f for the upstream advisory and release notes. The patched release enforces administrator role validation on the affected API endpoints.

Workarounds

Restrict network access to api.php to trusted administrator source addresses using web server access controls.
Temporarily disable reseller API access until the upgrade to 2.3.14 is completed.
Place the Froxlor administrative interface behind a reverse proxy that enforces additional authentication or source-IP allowlisting.

bash

# Configuration example: restrict api.php to administrator source IPs in nginx
location = /api.php {
    allow 203.0.113.10;   # admin workstation
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}