medium4.3
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob conf…
Impact
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.
Affected products
| Product | Affected versions |
|---|---|
| Froxlor 0.10.0 | before 2.3.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.