PT-2026-34637 · Froxlor · Froxlor

Offset · Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-41232

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.6

Description In the EmailSender::add() function, the domain ownership validation for full email sender aliases uses an incorrect array index when splitting the email address. This results in the local part of the address being passed to validateLocalDomainOwnership() instead of the domain. Consequently, the ownership check passes for non-existent domains, enabling any authenticated customer to add sender aliases for email addresses on domains owned by other customers. This allows the attacker to be authorized by Postfix's sender login maps to send emails as those addresses.

Recommendations Update to version 2.3.6.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41232

GHSA-VMJJ-QR7V-PXM6

Affected Products

Froxlor

References · 7

• 🔥 https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6 · Exploit
• https://github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07a · Patch
• https://osv.dev/vulnerability/GHSA-vmjj-qr7v-pxm6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41232 · Security Note
• https://github.com/froxlor/froxlor · Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://twitter.com/CVEnew/status/2047359884207718563 · Twitter Post