Security Advisory

CVE-2026-90935

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-14 12:48:30

Last updated 2026-09-14 14:06:53

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

← Browse all CVEs View on cve.org ↗