Threats tagged 'ghsa-7fmq-3hpx-jc23'

Froxlor versions prior to 2.3.15 have an authorization bypass vulnerability that allows authenticated customers to create MySQL databases even when the feature is disabled by the administrator. This occurs because the Mysqls.add API endpoint does not enforce the customer_hide_options check, enabling unauthorized database creation within the customer's quota despite policy restrictions.