{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0.10.0"
              },
              {
                "fixed": "2.3.14"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "DESCRIPTION"
            ]
          },
          "events": [
            {
              "introduced": "4b555b4ef2a97454fb16cc84a6272d7ea66b44ae"
            },
            {
              "fixed": "c147de18d29dc00360557787d783fa6907ebd902"
            }
          ],
          "repo": "https://github.com/froxlor/froxlor",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-mx7x-72gh-8j8f"
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109962.json"
  },
  "details": "Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.",
  "id": "CVE-2026-109962",
  "modified": "2026-10-15T02:30:56.837331323Z",
  "published": "2026-10-13T13:27:24.126Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109962.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109962"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-missing-authorization-in-mysqlserver-and-cronjobs-api"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API"
}