CVE-2026-90935 froxlor CVE debrief

Who should care

Defenders responsible for Froxlor installations and MySQL database security should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify Froxlor versions, restrict Mysqls.add API access, and monitor for suspicious activity.

Why it matters

CVE-2026-90935 allows attackers to bypass access controls in Froxlor, potentially leading to unauthorized MySQL database and user creation. Defenders should verify Froxlor versions, restrict Mysqls.add API access, and monitor for suspicious activity.

• Bypassing per-customer access controls to create MySQL databases and users on forbidden servers
• Potential unauthorized access to sensitive data or systems
• Need for verification of Froxlor versions and Mysqls.add API command access

Technical summary

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls. This vulnerability affects Froxlor installations and has implications for MySQL database security. Defenders should prioritize verifying Froxlor versions and restricting access to the Mysqls.add API command to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying Froxlor versions and restricting access to the Mysqls.add API command.

Recommended defensive actions

• Verify Froxlor version and upgrade to 2.3.7 or later
• Restrict access to the Mysqls.add API command
• Monitor for suspicious activity on MySQL databases and users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Further verification is needed to determine the full scope of affected systems and to confirm the accuracy of the provided details. Defenders should consult official advisories and track updates from Froxlor for comprehensive guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.