CVE-2026-41232: Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing
Froxlor is open source server administration software. Prior to version 2.3.6, in EmailSender::add(), the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to validateLocalDomainOwnership(). This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's senderloginmaps then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41232?
CVE-2026-41232 has a high severity due to its ability to allow cross-customer email spoofing.
How do I fix CVE-2026-41232?
To fix CVE-2026-41232, upgrade to Froxlor version 2.3.6 or later.
What effects does CVE-2026-41232 have on Froxlor?
CVE-2026-41232 enables email spoofing, allowing malicious users to send emails as if they were from another customer.
Who is affected by CVE-2026-41232?
Any Froxlor users running versions prior to 2.3.6 are affected by CVE-2026-41232.
What causes the vulnerability in CVE-2026-41232?
CVE-2026-41232 is caused by a wrong array index used during domain ownership validation in the EmailSender component.