Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100710Froxlor before 2.3.12 DKIM Private Key Disclosure via API
Medium 4.9
In plain English
A medium-severity information exposure in froxlor from froxlor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-79gx-h528-j9xf) vendor-advisory
- VulnCheck Advisory: Froxlor before 2.3.12 DKIM Private Key Disclosure via API third-party-advisory