Description

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T13:19:32.130Z",
  "pubdate": "2026-09-14T13:19:32.130Z",
  "executiveSummary": "Froxlor versions prior to 2.3.7 contain a broken access control vulnerability within the sender alias management system. The vulnerability exists in customer_email.php, where the application fails to enforce proper authorization scoping for sender alias lookups.\nBy manipulating the 'senderid' parameter during delete confirmation requests, an authenticated attacker can perform unauthorized enumeration of global sender alias IDs. This flaw allows an attacker to bypass multi-tenancy isolation and read sensitive configuration data belonging to other customers on the same platform.\nThe vulnerability requires an authenticated session, but does not necessitate administrative privileges, as any authenticated customer can exploit the lack of server-side ownership verification. Successful exploitation results in unauthorized information disclosure, potentially exposing email configurations and internal alias structures. Remediation requires an immediate update to version 2.3.7 or later to ensure that all database lookups are strictly bound to the authenticated user's session scope.",
  "technicalDetails": "The vulnerability is rooted in a failure to implement robust object-level authorization within the customer_email.php component of the Froxlor hosting management panel. Specifically, the application logic responsible for handling sender alias deletion requests does not validate whether the requested 'senderid' corresponds to an entity owned by the currently authenticated customer account.\nIn a secure multi-tenant environment, the backend should perform a query that includes an ownership constraint—typically a WHERE clause linking the 'senderid' to the customer_id associated with the active session. However, in vulnerable versions prior to 2.3.7, this scope validation is missing or insufficient.\nThe attack flow begins when an authenticated attacker intercepts a delete confirmation request sent to the application. By modifying the 'senderid' parameter value within the request, the attacker can submit IDs for aliases they do not own. Because the application logic fails to verify if the attacker has permissions for the specified ID, the backend proceeds to retrieve and display information associated with that ID as part of the confirmation process.\nThis behavior facilitates two primary attack vectors: First, enumeration, where an attacker iterates through integer-based ID values to map existing aliases across the entire system. Second, data exfiltration, where the attacker reads the configuration of these aliases, which may contain sensitive sender identity information. This represents an Insecure Direct Object Reference (IDOR) pattern, where the lack of server-side authorization checks allows for the subversion of the application's intended data partitioning.\nThe impact is significant for hosting environments as it allows cross-tenant information leakage. An attacker can map out the email architecture of other users, potentially revealing private domains, internal mailing structures, or sensitive sender address configurations. Since this occurs at the application level through standard HTTP requests, the exploitation is trivial once the attacker identifies the parameter manipulation target."
}