DKIM Private Key Disclosure in Froxlor by Froxlor GmbH

CVE-2026-100710

What is CVE-2026-100710?

Froxlor versions up to 2.3.10 expose sensitive DKIM private signing keys through several API responses, including Domains::get() and SubDomains::listing(). Authenticated non-superadmin admins with the 'customers_see_all' flag can exploit this flaw to retrieve private keys associated with domains they should not access. This leakage allows malicious users to sign emails for these domains, passing DKIM verification and DMARC alignment, leading to potential phishing attacks and email spoofing. The issue has been rectified in version 2.3.12, which ensures sensitive columns are not leaked in API responses.

References