CVE-2026-90936

EUVD-2026-77454
Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
froxlorfroxlor
𝑥
< 2.3.7
CNA
Common Weakness Enumeration
References
https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h
https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php
https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h