Information Disclosure in Froxlor by Froxlor Project

CVE-2026-90936

What is CVE-2026-90936?

The Froxlor application version prior to 2.3.7 contains a vulnerability in the customer_email.php file, where the scoping of sender alias lookups is improperly managed. This flaw allows authenticated attackers to manipulate sender ID parameters in delete confirmation requests, potentially leading to the enumeration of global sender alias IDs. Consequently, attackers may gain unauthorized access to sensitive sender values belonging to other customers, posing a significant risk to data privacy and security.

References