CVE-2026-41232 PUBLISHED

Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing

Assigner: GitHub_M
Reserved: 18.04.2026 Published: 23.04.2026 Updated: 23.04.2026

Froxlor is open source server administration software. Prior to version 2.3.6, in EmailSender::add(), the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to validateLocalDomainOwnership(). This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's sender_login_maps then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS Score: 5

Product Status

Vendor froxlor
Product froxlor
Versions
  • Version < 2.3.6 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE