CVE-2026-41232
Description
Froxlor is open source server administration software. Prior to version 2.3.6, in EmailSender::add(), the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to validateLocalDomainOwnership(). This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's sender_login_maps then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
froxlor/froxlorPackagist | < 2.3.6 | 2.3.6 |
Affected products
1Patches
177d04badf549fix domain-ownership validation in EmailSender.add
1 file changed · +1 −1
lib/Froxlor/Api/Commands/EmailSender.php+1 −1 modified@@ -97,7 +97,7 @@ public function add() if (!Validate::validateEmail($idna_convert->encode($allowed_sender))) { Response::standardError('emailiswrong', $allowed_sender, true); } - self::validateLocalDomainOwnership(explode("@", $allowed_sender)[0] ?? ""); + self::validateLocalDomainOwnership(explode("@", $allowed_sender)[1] ?? ""); } else { if (!Validate::validateDomain($idna_convert->encode(substr($allowed_sender, 1)))) { Response::standardError('wildcardemailiswrong', substr($allowed_sender, 1), true);
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07anvdPatchWEB
- github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6nvdExploitVendor AdvisoryMitigationWEB
- github.com/advisories/GHSA-vmjj-qr7v-pxm6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-41232ghsaADVISORY
- github.com/froxlor/froxlor/releases/tag/2.3.6nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.