CVE-2026-90936 in Froxlor
Summary
by MITRE • 09/14/2026
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Froxlor versions prior to 2.3.7 represents a critical failure in access control mechanisms, specifically within the customer_email.php module responsible for managing email configurations. This flaw allows authenticated users to bypass intended isolation boundaries between different customers hosted on the same server instance. The core technical issue lies in how the application handles sender alias lookups and deletions. When an authenticated user initiates a request to delete or manage a sender alias, the system fails to validate that the requested resource belongs exclusively to the requesting customer's account. Instead of enforcing strict ownership checks based on the session context, the application accepts arbitrary senderid parameters provided by the attacker without verifying their association with the current user profile.
This lack of proper scoping enables an authenticated attacker to perform unauthorized enumeration and data exfiltration attacks against other customers sharing the same Froxlor installation. By manipulating the senderid parameter in delete confirmation requests or similar API endpoints, an adversary can probe for valid alias IDs belonging to other users. If a specific ID corresponds to another customer's configuration, the system may return detailed information about that alias, such as its allowed sender values and associated email addresses. This behavior effectively transforms what should be a private administrative function into a tool for lateral movement and reconnaissance within the multi-tenant environment. The attacker does not need elevated privileges beyond standard user access; they simply exploit the missing authorization logic to peek into or potentially disrupt other users' mail configurations.
From an operational impact perspective, this vulnerability compromises the confidentiality of customer data and undermines the trust model inherent in hosting control panels like Froxlor. Exposing sender alias details can facilitate phishing campaigns by revealing legitimate email addresses associated with specific domains or organizations hosted on the platform. Furthermore, if the deletion logic is also affected by improper validation, an attacker might be able to delete other customers' aliases, leading to denial of service for those users who rely on these configurations for sending emails. The ability to enumerate resources across tenant boundaries indicates a fundamental weakness in how identity and access management are implemented within the application's backend logic, potentially violating compliance requirements related to data isolation in multi-tenant SaaS or hosting environments.
To mitigate this vulnerability, administrators must upgrade Froxlor to version 2.3.7 or later, where these authorization checks have been corrected to ensure that sender alias operations are strictly scoped to the authenticated user's account. In addition to upgrading, it is advisable to implement defense-in-depth strategies such as rigorous input validation and server-side ownership verification for all resource manipulation endpoints. Security teams should also monitor access logs for unusual patterns of requests involving non-existent or out-of-scope identifiers, which may indicate active exploitation attempts. Regular security audits focusing on broken object level authorization flaws are essential to maintain the integrity of multi-tenant applications.
This vulnerability is classified under CWE-284, Improper Access Control, as it involves a failure to restrict access to resources based on user identity or role. It also aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate credentials to perform unauthorized actions within an application due to flawed logic rather than credential theft. The exploitation vector is classified as Local if considering network boundaries but Remote when accounting for authenticated web access, falling under TA0005: Defense Evasion or TA0007: Discovery depending on whether the goal was purely enumeration or actual disruption of services.