PT-2026-34637 · Froxlor · Froxlor

Published 2026-04-23 · Updated 2026-04-23 · CVE-2026-41232

NVD

CVSS v3.1

5.0

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Froxlor is open source server administration software. Prior to version 2.3.6, in EmailSender::add(), the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to validateLocalDomainOwnership(). This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's sender login maps then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41232

Affected Products

Froxlor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41232 · Security Note
• https://github.com/froxlor/froxlor/releases/tag/2.3.6 · Note
• https://github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07a · Note
• https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6 · Note