Medium severity4.3NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026

CVE-2026-109962

Description

Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.

Affected products

Froxlor/Froxlorllm-fuzzy
Range: <2.3.14

Patches

Vulnerability mechanics

References

github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8fnvd
www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-missing-authorization-in-mysqlserver-and-cronjobs-apinvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000