CVE-2026-109962
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-285
Impact
Authenticated resellers can extract administrative MySQL server configurations and cronjob metadata via the API. Attackers only need valid reseller credentials to view internal database hostnames, ports, usernames, and TLS parameters.
Root cause
The API read endpoints MysqlServer.listing, MysqlServer.get, and Cronjobs.listing lack authorization checks that restrict access to full administrators.
Affected systems
Froxlor 0.10.0 before 2.3.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade Froxlor to version 2.3.14 or later. If patching immediately is not possible, revoke access for untrusted reseller accounts or restrict network access to api.php.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.