CVE-2026-41232: medium-severity vulnerability in froxlor
Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofing
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5epss 0.2%
Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to `validateLocalDomainOwnership()`. This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's `sender_login_maps` then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Affected products
froxlor · froxlorRelated CVEs — froxlor
In the same product, most dangerous first.
CVE-2026-54348HIGHFroxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationEPSS 0.7%CVE-2026-113678CRITICALFroxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronEPSS 0.6%CVE-2026-62988CRITICALFroxlor: Credential and 2FA secret disclosure via Froxlor API endpointsEPSS 0.6%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.6%CVE-2026-100714CRITICALFroxlor before 2.3.12 Command Injection via letsencryptchallengepathEPSS 0.5%CVE-2026-41228CRITICALFroxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code ExecutionEPSS 0.5%