The Mysqls.add API command in Froxlor (lib/Froxlor/Api/Commands/Mysqls.php) accepts a customer-controlled mysql_server parameter and only validates that it is numeric and exists in the server index list. It does not check if the mysql_server is in the calling customer's allowed_mysqlserver allowlist. This omission allows a customer to create databases and MySQL users on any MySQL server configured by the operator, including those explicitly excluded from that customer. Other API commands and the UI correctly enforce the allowed_mysqlserver check, confirming this is a bug. The vulnerability affects Froxlor versions before 2.3.7. Exploitation requires authenticated API access and allows unauthorized database creation on disallowed servers.

An authenticated customer can create MySQL databases and users on any MySQL server configured in Froxlor, including servers that are explicitly disallowed for that customer. This can lead to unauthorized use of database resources, potential privilege escalation, and cross-tenant access in multi-tenant environments. The vulnerability does not disclose data directly but allows unauthorized modification of database resources on restricted servers.

A fix is available in Froxlor version 2.3.7 and later. Users should upgrade to version 2.3.7 or newer to ensure the mysql_server parameter is properly validated against the customer's allowed_mysqlserver list. Until patched, restrict API access to trusted customers only and monitor for unauthorized database creation attempts. Patch status is not explicitly stated in the input but the affectedVersions field indicates versions before 2.3.7 are vulnerable, implying 2.3.7 contains the fix.