CVE-2026-90936

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936

Froxlor before version 2.3.7 contains an information disclosure vulnerability in customer_email.php . The root cause is a failure to properly scope sender alias lookups to the current customer. An authenticated attacker can supply arbitrary senderid parameters in delete confirmation requests to e...

CVE-2026-90936 Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

EUVD-2026-77454

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...

CVE-2026-90936: Exposure of Sensitive Information to an Unauthorized Actor

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customeremail.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests...