Froxlor up to 2.3.10 Allowed-Sender Feature EmailSender.add improper authorization

Summaryinfo

A vulnerability was found in Froxlor up to 2.3.10. It has been declared as critical. Affected by this vulnerability is the function EmailSender.add of the component Allowed-Sender Feature. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2026-100718. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Froxlor up to 2.3.10. It has been rated as critical. Affected by this issue is the function EmailSender.add of the component Allowed-Sender Feature. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-100718 since 09/26/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 2.3.12 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-87691). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Froxlor

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10

License

• open-source

Website

• Product: https://github.com/froxlor/froxlor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion