CVE-2026-90935— Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Quick assessment
Affected
froxlor froxlor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Froxlor 2.3.7 之前的版本在 Mysqls.add API 命令中未能对 参数进行有效校验，以检查其是否属于客户被允许的 允许列表。攻击者可以提供一个不在允许列表中的服务器索引，从而在禁止使用的服务器上创建 MySQL 数据库和用户，绕过针对每个客户的访问控制机制。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90935
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API
Source: CVE Program / CVE List V5
Vulnerability Description
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90935
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90935
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90935 (2)
Same Patch Batch · froxlor · 2026-09-14 · 4 CVEs total
| CVE-2026-90937 | 9.9 CRITICAL | froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL |
| CVE-2024-58383 | 7.3 HIGH | Froxlor before 2.2.0 Insecure File Permissions mysql.conf |
| CVE-2026-90936 | 4.3 MEDIUM | Froxlor before 2.3.7 Information Disclosure via customer_email.php |
IV. Related Vulnerabilities
Same product: froxlor
-
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection vi -
CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf -
CVE-2026-90767
Froxlor before 2.3.12 SSH Key Injection via authorized_keys -
CVE-2026-55593
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missi
Same vendor: froxlor
-
CVE-2026-90937
froxlor before 2.2.5 nginx/Apache Configuration Injection vi -
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf -
CVE-2026-90767
Froxlor before 2.3.12 SSH Key Injection via authorized_keys -
CVE-2026-55593
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missi
Same weakness: CWE-285
-
CVE-2026-55236
langgraph-api: Incomplete assistant authorization in LangGra -
CVE-2026-90566
Rizwan17 inventory-management-system Registration register.p -
CVE-2026-90520
jaychouchannel Tourism-Management-System Authorization Inter -
CVE-2026-90499
lenve vhr Password Update pass HrInfoController.updatePass i -
CVE-2026-44715
OpenMRS has Broken Access Control in HL7 Configuration
V. Comments for CVE-2026-90935
No comments yet