Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100718Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

High 7.1

In plain English

A high-severity incorrect default permissions in froxlor from froxlor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.

Affected products (as reported)

Vendor	Product	Versions
froxlor	froxlor	0 – before 2.3.12

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

GitHub Security Advisory (GHSA-m9j6-9856-68xf) vendor-advisory
VulnCheck Advisory: Froxlor before 2.3.12 Authentication Bypass via EmailSender.add third-party-advisory