CVE-2026-121435
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke Mysqls.add even when the admin has disabled the MySQL feature, creating unauthorized databases within their own quota despite the policy.