CVE-2026-100710: Froxlor before 2.3.12 DKIM Private Key Disclosure via API
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the paneldomains table and return the row unmodified, including the paneldomains.dkimprivkey field. An authenticated, non-superadmin admin holding the delegated customersseeall flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data2fa but not dkimprivkey. The issue is fixed in 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Which deployments are exposed to cross-tenant DKIM key disclosure?
Froxlor deployments through 2.3.10 are affected when a non-superadmin administrator has the delegated customers_see_all flag. That administrator can retrieve DKIM private keys for domains visible through the affected API methods, including domains belonging to other tenants.
What access does an attacker need?
The attacker needs authenticated API access as a non-superadmin admin account with customers_see_all delegated. No user interaction is required, and a single listing request can disclose keys for every visible domain.
Which API operations can expose the keys?
The affected operations are Domains::get(), Domains::listing(), SubDomains::get(), and the administrator branch of SubDomains::listing(). They return unfiltered panel_domains records containing the dkim_privkey field.
What is the impact if a DKIM private key has been disclosed?
An attacker with a disclosed key can sign email that passes DKIM verification and DMARC alignment for the affected domain. Upgrading addresses the API disclosure, but the provided information does not state whether exposed DKIM keys are automatically replaced.
What version contains the fix?
The issue is fixed in Froxlor 2.3.12.