What is CVE-2026-90935?

CVE-2026-90935 is a medium-severity vulnerability in Froxlor, classified under Improper Authorization. CVSS score: 4.3/10. Published 2026-09-14.

How severe is CVE-2026-90935?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Froxlor

CVE-2026-90935

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Froxlor

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-90935?: CVE-2026-90935 is a medium-severity vulnerability in Froxlor, classified under Improper Authorization. CVSS score: 4.3/10. Published 2026-09-14.
How severe is CVE-2026-90935?: Medium severity. CVSS v3 base score is 4.3 out of 10.