CVE-2026-90936 — Froxlor before 2.3.7 Information Disclosure via customer_email.php
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs an…
Published: 2026-09-14 · CVSS: 5.3 · CVSS 4.0
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7