CVE-2026-90936

Description

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

References

• https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h
• https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php