5 matches found
CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...
CVE-2026-100718
Froxlor versions through 2.3.10 contain a vulnerability where the EmailSender.add API command fails to enforce the mail.allow_external_domains policy. If an administrator enables the allowed-sender feature but disables external domains (mail.enable_allow_sender = 1, mail.allow_external_domains = ...
EUVD-2026-87691
Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...
CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...
CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
Froxlor through 2.3.10 does not enforce the mail.allowexternaldomains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains mail.enableallowsender = 1, mail.allowexternaldomains = 0, an authenticated...