Description

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T13:19:31.987Z",
  "pubdate": "2026-09-14T13:19:31.987Z",
  "executiveSummary": "A critical access control vulnerability exists in the Froxlor administration panel, specifically within the Mysqls.add API command. The vulnerability allows authenticated users to bypass existing security constraints by supplying a malicious mysql_server parameter. By circumventing the customer-specific allowlist validation, an attacker can provision MySQL databases and user accounts on unauthorized or forbidden database servers.\nThe flaw stems from insufficient server-side validation of user-supplied input during the database creation process. Impacted versions include all releases of Froxlor prior to 2.3.7. The vulnerability poses a significant risk to data confidentiality and integrity, as unauthorized actors can manipulate external or restricted database infrastructure. Successful exploitation requires an authenticated session with sufficient privileges to interact with the API, allowing an attacker to escalate their footprint across the hosting infrastructure by leveraging the internal database management capabilities of the platform.",
  "technicalDetails": "The vulnerability is categorized as an improper access control issue residing within the API endpoint responsible for managing MySQL server resources. The root cause of this flaw is the lack of strict server-side verification of the 'mysql_server' parameter against the 'allowed_mysqlserver' configuration associated with the specific customer account. During the execution of the Mysqls.add API command, the application logic assumes the integrity of the provided server index without re-validating the association between the requesting user and the specified resource.\nIn a standard deployment, Froxlor implements multitenancy by restricting individual customers to a predefined subset of available database servers defined in their 'allowed_mysqlserver' list. When a customer submits a request to create a new database or user, the API is intended to verify that the target server resides within this authorized set. However, in vulnerable versions prior to 2.3.7, the verification logic fails to perform this check adequately. An attacker can manipulate the API request payload to inject an arbitrary server index that corresponds to a server they are not authorized to manage.\nThe attack flow proceeds as follows: First, the attacker authenticates as a legitimate customer. Second, the attacker interacts with the Mysqls.add API, crafting a request that includes the index of a forbidden or internal MySQL server. Third, because the backend logic fails to validate the requested server index against the customer's specific permissions, the application proceeds to communicate with the target database server. Finally, the application executes the requested database or user creation commands on the unintended server, effectively granting the attacker unauthorized control over database resources.\nThe exploitation of this vulnerability allows for post-exploitation activities such as unauthorized data storage, cross-tenant resource consumption, or potential lateral movement if the targeted database server contains sensitive information from other accounts. Because the action is performed by the application backend, the changes are committed directly to the unauthorized database server, which may also result in configuration drift or security policy violations within the hosting environment. The vulnerability effectively neuters the intended logical isolation between customers, allowing for unauthorized resource allocation outside the attacker's restricted scope."
}