CVE-2026-90936

Summary

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

Affected Software

Weaknesses

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h

References

• https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h
• https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php

• ←Previous
• Next→