CVE-2026-90936

MEDIUM 4.3

Froxlor before 2.3.7 Information Disclosure via customer_email.php

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

CWE	CWE-200
Vendor	froxlor
Product	froxlor
Published	Sep 14, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for froxlor froxlor

Be the first to know when new medium vulnerabilities affecting froxlor froxlor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

froxlor / froxlor

0 < 2.3.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h vulncheck.com: https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php

Credits

🔍 adrgs aisafe-bot