CVE-2026-109962

Executive Summary

CVE-2026-109962 is a missing authorization vulnerability in Froxlor (versions 0.10.0 through 2.3.13) that permits reseller-level accounts to retrieve administrative-only MySQL server and cronjob configuration through API read commands. Although the CVSS score is only 4.3 (low), the exposed data includes management usernames, hosts, ports, TLS settings, and cron metadata—information that materially aids lateral movement and privilege escalation. Any multi-tenant Froxlor deployment with reseller accounts is affected; no public exploit or PoC is currently available.

Technical Analysis

Froxlor is a server management panel used to administer web hosting environments (domains, mail, MySQL, cron, FTP). The software exposes an API entry point, api.php, used by privileged and unprivileged roles to perform administrative operations. CVE-2026-109962 is classified as CWE-285 (Improper Authorization). Specifically, the authorization check that should restrict administrative configuration data to full-admin accounts is missing for three read operations:

• MysqlServer.listing
• MysqlServer.get
• Cronjobs.listing

A reseller account—normally scoped to a subset of customers and resources—can invoke these commands and receive data that is intended only for full administrators. The leaked fields include management usernames, hostnames, ports, TLS configuration, and cronjob metadata.

The root cause is an access-control gap: the role-based check on these specific API operations is absent or insufficiently scoped. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the vulnerability is remotely reachable, requires only low privileges (a valid reseller account), needs no user interaction, and results in limited confidentiality impact with no integrity or availability impact. No code-level constructs, function names, or parameter names beyond the three API read commands named in the NVD description should be assumed; the precise implementation of the authorization check is not disclosed.

Attack surface: any network-reachable Froxlor instance exposing api.php with reseller accounts enabled. The API appears to be the primary and possibly only vector—no other file paths or endpoints are referenced in the available data.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (missing authorization on specified API read commands).

1. Reconnaissance / target identification. The attacker identifies a Froxlor installation via its login page or management interface and confirms that api.php is reachable. A valid reseller account is required; this may be obtained legitimately (low-privilege tenant) or via credential theft/phishing.

2. Triggering the flaw. Using the reseller session/credentials, the attacker issues read requests to the API targeting MysqlServer.listing, MysqlServer.get, or Cronjobs.listing. Because the missing authorization check does not distinguish reseller from full-admin, the server returns data the reseller should never see.

3. Data retrieval (vulnerability-class level). The responses disclose MySQL server configuration details—management usernames, hostnames, ports, and TLS settings—and cronjob metadata. No payload injection or memory corruption is involved; the attack is simply an unauthorized API call returning over-permissioned data.

4. Post-exploitation impact. Leaked management usernames, hosts, and ports are high-value recon for targeting the backend MySQL infrastructure (e.g., password spraying, network mapping). Cron metadata may reveal scheduled tasks and service topology. The attacker can chain this with other weaknesses to escalate from reseller to administrator or to pivot into the database tier. Integrity and availability are not directly impacted.

Impact Assessment

• Confidentiality: Low (C:L). Exposure is limited to configuration metadata, not customer data or plaintext credentials (no password disclosure is stated).
• Integrity: None (I:N). No modification of data is possible through these read operations.
• Availability: None (A:N).
• Privileges required: Low (PR:L) — any valid reseller account suffices.
• Attack vector: Network (AV:N), no user interaction (UI:N), scope unchanged (S:U).

Business impact: Multi-tenant hosting providers running Froxlor are the primary victims. Leaked MySQL server details and cron metadata enable targeted attacks against backend infrastructure and aid lateral movement. The blast radius is confined to the Froxlor instance and the systems it manages, but the intelligence value of the leaked data is disproportionate to the 4.3 score. Tenants relying on the reseller isolation guarantee may be at indirect risk if the provider's database tier is subsequently compromised.

Detection Guidance

Sigma Rule

title: Froxlor Missing Authorization - Reseller Access to Admin MySQL/Cron API
id: 8a1f3c2e-7b4d-4e9a-9c6f-2d5e8a1b0f3c
status: experimental
description: Detects reseller-role API requests to Froxlor admin-only read commands
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109962
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-query|contains:
      - 'MysqlServer.listing'
      - 'MysqlServer.get'
      - 'Cronjobs.listing'
  selection_path:
    cs-uri-stem|endswith: '/api.php'
  condition: selection_path and selection_method and selection_uri
falsepositives:
  - Legitimate full-admin API usage
level: medium

YARA Rule

rule CVE_2026_109962_Froxlor_Unauth_API
{
    meta:
        description = "Detects Froxlor API read commands abused via missing authorization"
        reference = "CVE-2026-109962"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $a = "MysqlServer.listing" ascii nocase
        $b = "MysqlServer.get" ascii nocase
        $c = "Cronjobs.listing" ascii nocase
        $d = "api.php" ascii nocase
    condition:
        $d and any of ($a, $b, $c)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109962 Froxlor Missing Authorization - Reseller Admin API Read"; flow:established,to_server; http.uri; content:"/api.php"; http.uri; content:"MysqlServer.listing"; nocase; http.uri; content:"MysqlServer.get"; nocase; http.uri; content:"Cronjobs.listing"; nocase; distance:0; classtype:attempted-recon; reference:cve,2026-109962; sid:2026109962; rev:1;)

(Deploy with an OR condition across the three command strings; adjust to your Suricata version for multi-content matching.)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where url.path endswith "/api.php" and url.query : ("MysqlServer.listing" or "MysqlServer.get" or "Cronjobs.listing") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/api.php*"
| search uri_query IN ("*MysqlServer.listing*","*MysqlServer.get*","*Cronjobs.listing*")
| stats count values(uri_query) as commands by src_ip, user, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,froxlor,">
  <rule id="109962" level="8">
    <if_sid>31100</if_sid>
    <url>api\.php</url>
    <match>MysqlServer\.listing|MysqlServer\.get|Cronjobs\.listing</match>
    <description>CVE-2026-109962: Froxlor reseller accessing admin-only MySQL/Cron API read command</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to api.php to trusted management networks only.
   • Audit reseller accounts and disable any not actively required.
   • Monitor and alert on the three named read commands when invoked by non-admin roles.
   • Enforce MFA and strong credentials on reseller accounts to reduce the risk of account acquisition.

2. Patch/upgrade steps:

   • The NVD description references "before 2.3.14" as the affected range; however, no vendor advisory, patched release, or workaround is confirmed by any tracked source. Treat this as unpatched. Monitor the Froxlor project for an official security release and validate the fix before relying on it.
   • Do not apply unverified third-party patches. Until a vendor fix is available, rely on mitigations.

3. Long-term hardening:

   • Implement strict role-based access control reviews across the API surface; enforce authorization server-side on every read operation.
   • Log all API calls with role context and alert on privilege anomalies.
   • Apply the principle of least privilege to reseller accounts.
   • Conduct regular security testing of multi-tenant isolation boundaries.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109962
• Froxlor project: https://froxlor.org/
• MITRE CWE-285 (Improper Authorization): https://cwe.mitre.org/data/definitions/285.html
• MITRE ATT&CK T1078 (Valid Accounts): https://attack.mitre.org/techniques/T1078/
• CISA KEV catalog: Not listed (verified: NO as of report date)

No public PoC, exploit code, or Nuclei template is available. No threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE.