CVE-2026-90936

Froxlor before version 2.3.7 contains an information disclosure vulnerability in customer_email.php . The root cause is a failure to properly scope sender alias lookups to the current customer. An authenticated attacker can supply arbitrary senderid parameters in delete confirmation requests to e...