CVE-2026-90935

Executive Summary

CVE-2026-90935 is an improper authorization vulnerability in Froxlor, an open-source server management and hosting control panel, affecting versions prior to 2.3.7. The Mysqls.add API command fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist, allowing an authenticated customer to create MySQL databases and users on database servers they are not permitted to access. The impact is a low-severity integrity violation (CVSS 4.3) constrained to per-customer access control bypass; exploitation requires authenticated access with existing privileges (PR:L).

Technical Analysis

Froxlor is a web-based server management panel commonly used by shared hosting providers to provision and delegate resources — including web space, FTP accounts, email, and MySQL database instances — to individual customers. A defining feature of multi-tenant hosting panels is the enforcement of per-customer resource boundaries: a customer must be constrained to the servers, directories, and databases that their administrator has explicitly granted.

CVE-2026-90935 describes a failure of that boundary enforcement in the Froxlor API layer. The Mysqls.add API command is responsible for creating MySQL databases and associated users on behalf of a customer. It accepts a mysql_server parameter that selects which configured MySQL server the operation targets. Per the NVD description, the command "fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist."

The root cause maps to CWE-285 (Improper Authorization). An allowlist mechanism — allowed_mysqlserver — exists and is intended to restrict which database servers a given customer may use. However, the Mysqls.add command does not consult or enforce that allowlist before acting on the caller-supplied mysql_server value. This is a classic case of server-side authorization being assumed rather than verified: the UI or intended workflow may only present allowed servers, but the API accepts an arbitrary server index, enabling direct parameter manipulation to bypass the constraint.

Attack surface: the Froxlor API endpoint that dispatches the Mysqls.add command. Because this is an authenticated API command, the attacker must already hold a valid customer-level session or API credentials. There is no public vulnerability description indicating that the flaw is reachable pre-authentication, so it is treated here strictly as a post-authentication authorization bypass.

Severity context: the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects network reachability, low complexity, and required low-level privileges, with the resulting impact scored as a low integrity violation only. There is no confidentiality impact and no availability impact — the flaw permits the creation of unauthorized database resources but does not directly expose data or take servers offline.

Patch confidence is rated 2/4 (CLAIMED). A single source (OSV) indicates that Froxlor 2.3.7 addresses the issue, but no vendor advisory has been independently confirmed in the supplied data. Affected version range in the source is stated as "0 → unfixed" in the OSV package feed, while the NVD description explicitly scopes the issue to "Froxlor before 2.3.7."

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description. No public PoC, Nuclei template, or exploit code was observed at time of writing.

1. Reconnaissance / target identification. The attacker identifies a Froxlor-managed hosting environment, typically by fingerprinting the panel's login/API surface. They require a valid customer-level account, which on shared hosting platforms may be obtainable through legitimate signup or via compromise of a low-privileged tenant account. The attacker enumerates available database server indices — for instance, by observing server values in legitimate responses or by simply iterating small integer indices.

2. Triggering the flaw. The attacker issues an authenticated call to the Mysqls.add API command (the mechanism is direct API invocation; the exact HTTP method, endpoint path, and payload schema are not specified in the available description and are therefore not asserted here). The critical action is supplying a mysql_server value that corresponds to a server index outside the customer's allowed_mysqlserver allowlist.

3. Payload / execution method at the class level. Because Mysqls.add does not validate mysql_server against allowed_mysqlserver, the command proceeds to create a MySQL database and MySQL user on the disallowed server. From the panel's perspective, the creation succeeds; from the tenant-isolation perspective, the authorization check was skipped entirely. The "payload" is the crafted API request carrying the unauthorized server index — no memory corruption or code injection is involved.

4. Post-exploitation impact. The attacker now owns MySQL databases and users on database servers the hosting provider intended to keep isolated from that customer. This can be a stepping stone: a database user on an unintended server may reach data belonging to other tenants, or provide a foothold on a host the provider considered out of scope. Although the direct CVSS impact is low (integrity only), in a multi-tenant provider context the creation of unmanaged database principals is a real isolation failure and can be chained with later abuse. Note: the CVSS vector assigns no confidentiality impact (C:N); any cross-tenant data access would be a downstream consequence not explicitly scored by this CVE.

Because no public exploit artifacts exist, defenders should treat this scenario as a reasoned model of the attack, not a reproducible recipe. Operators of multi-tenant Froxlor deployments should prioritize verification of their own exposure.

Impact Assessment

Business impact. For hosting providers and MSPs running Froxlor for tenant management, this CVE represents a multi-tenant isolation weakness. A malicious or compromised customer can provision MySQL databases and user accounts on database servers that administrators explicitly did not authorize for that tenant. This undermines the provider's resource-governance model and can complicate billing, capacity planning, and security audit boundaries.

Affected systems. Froxlor installations before 2.3.7 that (a) are configured with multiple MySQL servers, and (b) use the allowed_mysqlserver per-customer allowlist feature. Single-server deployments are largely unaffected because there is no disallowed server to escape to.

Blast radius. Constrained by the CVSS vector: PR:L (attacker needs a low-privileged authenticated account), UI:N (no user interaction), S:U (impact scoped to the vulnerable component), and impact C:N/I:L/A:N. There is no confidentiality or availability impact scored. The primary risk is unauthorized configuration state (rogue DBs/users) and potential downstream lateral movement into tenant environments that were meant to remain isolated.

Exploitability signals. EPSS is 0.00214 (12.0th percentile) — low exploitation likelihood in the short term. CISA KEV: NO. No PoC, no Nuclei template, no exploit code. This is a low-urgency, authenticated, integrity-only issue, best handled in routine patching rather than emergency response.

Detection Guidance

Sigma Rule

title: Froxlor Mysqls.add Unauthorized MySQL Server Creation
id: 7f4c1a2e-9093-5b6d-9c1a-froxlor90935
status: experimental
description: Detects Froxlor Mysqls.add API requests referencing MySQL server indices, indicating potential allowed_mysqlserver allowlist bypass (CVE-2026-90935).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90935
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_cmd:
    cs-uri-query|contains: 'Mysqls.add'
  selection_param:
    cs-uri-query|contains: 'mysql_server'
  condition: selection_cmd and selection_param
falsepositives:
  - Legitimate Froxlor administrative activity provisioning databases on allowed servers.
level: medium
tags:
  - attack.t1190
  - cve.2026.90935

YARA Rule

rule CVE_2026_90935_Froxlor_Mysqls_Add
{
    meta:
        description = "Detects requests referencing the Froxlor Mysqls.add API command with a mysql_server parameter - potential allowlist bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90935"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cmd = "Mysqls.add" ascii nocase
        $param = "mysql_server" ascii nocase
        $allow = "allowed_mysqlserver" ascii nocase

    condition:
        $cmd and $param
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90935 Froxlor Mysqls.add mysql_server allowlist bypass attempt"; flow:established,to_server; http.uri; content:"Mysqls.add"; nocase; http.uri; content:"mysql_server"; nocase; classtype:attempted-user; reference:cve,2026-90935; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90935; sid:90090935; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and
      url.query contains "Mysqls.add" and
      url.query contains "mysql_server" ]

Splunk SPL Query

index=web
| search cs_uri_query="*Mysqls.add*" cs_uri_query="*mysql_server*"
| eval server_index = mvindex(split(cs_uri_query, "mysql_server="), 1)
| table _time, src_ip, cs_uri_query, server_index, status
| sort - _time

Wazuh OSSEC Rule

<group name="froxlor,web,accesslog,">
  <rule id="100935" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>Mysqls.add</url>
    <url>mysql_server</url>
    <description>CVE-2026-90935: Froxlor Mysqls.add request with mysql_server parameter - possible allowed_mysqlserver allowlist bypass.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_90935,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED). A single source (OSV) indicates that Froxlor 2.3.7 resolves CVE-2026-90935. This has not been independently confirmed against a vendor advisory. Treat as provisional and verify against the official Froxlor release notes before relying on it.

1. Immediate mitigations (until patch is verified/deployed):

   • Restrict access to the Froxlor API to trusted networks where feasible, and enforce strong authentication for all customer accounts.
   • Audit Froxlor configuration: identify all customers with an allowed_mysqlserver allowlist defined and confirm, via database inspection, that no MySQL databases or users exist on servers outside each customer's allowlist.
   • Review Froxlor audit/webserver logs for Mysqls.add requests whose mysql_server value falls outside the requesting customer's allowed range.
   • If multiple MySQL servers are provisioned but per-customer allowlisting is not required, consider whether unused servers can be removed from Froxlor's configuration to reduce the attack surface.

2. Patch / upgrade steps:

   • Upgrade Froxlor to 2.3.7 or later, per the OSV-sourced claim.
   • Confirm the fix by consulting the official Froxlor changelog/release notes and repository commits for the 2.3.7 milestone.
   • After upgrade, re-run the log audit to confirm Mysqls.add now rejects unauthorized mysql_server values.

3. Long-term hardening:

   • Enforce server-side authorization checks in every API command that consumes tenant-supplied resource selectors — never rely on the UI to constrain input.
   • Adopt centralized, testable authorization middleware for resource-ownership and allowlist enforcement, with regression tests covering parameter-tampering cases.
   • Apply least privilege to Froxlor's own database/management credentials so a panel-level bypass cannot translate into broad database control.
   • Monitor EPSS and vendor channels; low-EPSS authenticated flaws can still be weaponized by malicious tenants in shared-hosting environments.

References

1. NVD — CVE-2026-90935: https://nvd.nist.gov/vuln/detail/CVE-2026-90935
2. OSV advisory entry for Froxlor (patch indicator for 2.3.7): https://osv.dev/
3. Froxlor official project / release notes: https://froxlor.org/
4. CWE-285: Improper Authorization — https://cwe.mitre.org/data/definitions/285.html
5. MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or exploit-in-the-wild evidence were identified at time of writing (CISA KEV: NO; EPSS 0.00214; no public PoC).