Vulnerability Bulletins |
CVE-2026-90935 |
|
| Affected software | MYSQL |
| Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-90935 | |