Froxlor authorization bypass in Mysqls.add API

Executive brief

Froxlor is a web hosting management panel used by service providers to manage servers and customer accounts. A security flaw in the system's programming interface (API) allows customers to create databases on servers they are not authorized to use. While this does not allow customers to see each other's data, it allows them to bypass billing tiers or use restricted infrastructure, potentially leading to unexpected resource costs or policy violations for the hosting provider.

Technical details

An authorization bypass exists in the `Mysqls.add` API command within `lib/Froxlor/Api/Commands/Mysqls.php`. The component fails to validate the user-supplied `mysql_server` parameter against the customer's `allowed_mysqlserver` allowlist, only performing a basic numeric and existence check. An authenticated attacker with API access can specify the index of any configured database server to create a new database and user. While the attacker only gains privileges over their newly created database (preventing cross-tenant data exposure), they can successfully bypass administrative placement policies and resource quotas on restricted or premium database clusters. The vulnerability is addressed in version 2.3.7.

Affected products

• froxlor froxlor <= 2.3.6

Timeline

• 2026-05-29: disclosed
• 2026-07-02: advisory

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D