CVE-2026-90935: Froxlor Auth Bypass Vulnerability

CVE-2026-90935 Overview

CVE-2026-90935 is an authorization bypass vulnerability in Froxlor server management panel versions prior to 2.3.7. The flaw resides in the Mysqls.add API command, which fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist. An authenticated customer can supply an arbitrary MySQL server index and create databases and users on servers outside their permitted scope. The issue is classified under CWE-285: Improper Authorization and undermines the per-customer isolation model that multi-tenant hosting deployments rely on.

Critical Impact
Authenticated Froxlor customers can provision MySQL databases and users on any configured MySQL server, breaking tenant boundaries in shared hosting environments.

Affected Products

Froxlor server administration panel, all versions before 2.3.7
Deployments configured with multiple MySQL servers and per-customer allowed_mysqlserver allowlists
Shared hosting environments using Froxlor's multi-tenant customer model

Discovery Timeline

2026-09-14 - CVE-2026-90935 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90935

Vulnerability Analysis

Froxlor exposes an API command named Mysqls.add that allows customers to provision MySQL databases. Each customer record contains an allowed_mysqlserver field defining which backend MySQL servers that account may target. The vulnerable code path accepts the caller-supplied mysql_server index and passes it directly to database provisioning logic without cross-checking membership in the allowlist. As a result, authorization is effectively enforced only in the UI, not at the API layer. See the GitHub Security Advisory and the VulnCheck Advisory on Authorization Bypass for the underlying report.

Root Cause

The root cause is a missing authorization check [CWE-285] in the Mysqls.add handler. The handler trusts the mysql_server parameter provided by the authenticated caller and does not verify it against the customer's allowed_mysqlserver list before executing the create operation. This is a server-side access control gap, not a client-side or session issue.

Attack Vector

Exploitation requires valid customer credentials with API access to the Froxlor panel. The attacker invokes the Mysqls.add API command and supplies a mysql_server index that belongs to another tenant or to an administrative pool. Froxlor then creates the requested MySQL database and user on that forbidden server. The impact is limited to integrity of MySQL provisioning: attackers can add databases and users on disallowed servers, but the flaw itself does not expose or corrupt existing tenant data.

No verified public exploit code is available. Refer to the VulnCheck Advisory on Authorization Bypass for reproduction details.

Detection Methods for CVE-2026-90935

Indicators of Compromise

MySQL databases or user accounts appearing on servers that a given Froxlor customer is not authorized to use.
Froxlor API access logs containing Mysqls.add calls with mysql_server values not present in the requesting customer's allowed_mysqlserver list.
Unexpected CREATE DATABASE or CREATE USER statements on backend MySQL servers originating from Froxlor's provisioning account.

Detection Strategies

Correlate Froxlor API request logs with each customer's allowed_mysqlserver configuration and flag mismatches on Mysqls.add.
Audit the panel_databases table and compare dbserver values with the owning customer's allowlist to surface historical abuse.
Enable MySQL general query or audit logging on all backend servers and alert on provisioning activity that lacks a matching authorized Froxlor request.

Monitoring Recommendations

Track the count of MySQL databases per customer per backend server and alert on new server assignments.
Monitor Froxlor version banners across managed instances to detect hosts still running versions before 2.3.7.
Forward Froxlor and MySQL logs to a central analytics platform for cross-tenant anomaly review.

How to Mitigate CVE-2026-90935

Immediate Actions Required

Upgrade Froxlor to version 2.3.7 or later on all panel instances.
Review panel_databases and MySQL user tables on every backend server for entries that violate customer allowlists and remove unauthorized objects.
Rotate credentials for any MySQL users that may have been provisioned on unintended servers.
Restrict Froxlor API access to trusted networks where operationally feasible.

Patch Information

The vulnerability is fixed in Froxlor 2.3.7. The patched Mysqls.add handler validates the mysql_server parameter against the customer's allowed_mysqlserver list before performing provisioning. Refer to the GitHub Security Advisory for the fix commit and release notes.

Workarounds

If immediate upgrade is not possible, disable customer access to the Mysqls.add API endpoint at the web server or reverse proxy layer.
Reduce risk by configuring only a single MySQL server per Froxlor instance so all customers share the same backend and cross-tenant server selection is not possible.
Temporarily revoke API token issuance for customer accounts until the panel is patched.

bash

# Configuration example: block Mysqls.add API command at nginx until patched
location = /api.php {
    if ($request_body ~* "\"command\"\s*:\s*\"Mysqls\\.add\"") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}