Vulnerability in froxlor

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund28 Sep 2026WID-SEC-2026-3629

  Froxlor: Multiple vulnerabilities Translated from German

  CVE-2026-109961CVE-2026-109963CVE-2026-109960+1 more CVEs

[ References ]References

• github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f
• www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-missing-authorization-in-mysq…