CVE-2026-90936: Froxlor before 2.3.7 Information Disclosure via customer_email.php
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Froxlor and able to submit delete confirmation requests in customer_email.php. The provided data does not indicate that unauthenticated users can exploit it.
What information can be exposed?
An authenticated attacker can enumerate global sender alias IDs and view allowed sender values belonging to other customers. The issue is an information disclosure; no integrity or availability impact is described.
Which versions are affected?
Froxlor versions before 2.3.7 are affected. Updating to 2.3.7 or later addresses the version range identified in the advisory.