Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Description

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.

Scores

EPSS (exploitation in 30 days)

0.19% · top 92% of all CVEs (4 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

• CWE-276: Incorrect Default Permissions (opens in a new tab)All about CWE-276 and its CVEs

Affected products

• froxlor · froxlor

  • affected < 2.3.12
  • unaffected 2.3.12

References (2)

• GitHub Security Advisory (GHSA-m9j6-9856-68xf) (opens in a new tab)vendor-advisory
• VulnCheck Advisory: Froxlor before 2.3.12 Authentication Bypass via EmailSender.add (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-100718](https://trackcve.app/badge/CVE-2026-100718.svg)](https://trackcve.app/cve/CVE-2026-100718)

Record last updated 26 Sept 2026, 23:07 UTC.