CVE-2026-100718: Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enableallowsender = 1, mail.allowexternaldomains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Froxlorto a version that resolves this vulnerability.Fixed in 2.3.12
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
The issue affects Froxlor through 2.3.10 when allowed senders are enabled (mail.enable_allow_sender = 1) and external allowed-sender domains are disabled (mail.allow_external_domains = 0). Exploitation also depends on the generated mail configuration consuming the allowed-sender table.
What access does an attacker need?
An attacker must be an authenticated customer with API access. They can invoke the EmailSender.add API command to register an arbitrary external sender address for their mailbox.
Is the administrator's restriction on external sender domains effective against the API?
No. Under the affected configuration, EmailSender.add does not enforce mail.allow_external_domains, so the external sender address can be stored despite the policy.
What version contains the fix?
The issue is fixed in Froxlor 2.3.12.