Froxlor information disclosure in sender alias delete confirmation

Executive brief

Froxlor is a server management panel used to manage web hosting and email services. A security flaw allows an authenticated customer to view the email sender aliases of other customers on the same server. This could lead to the exposure of private email addresses or internal routing information across different accounts.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in `customer_email.php` due to insufficient ownership validation. The application fetches sender alias data from the `mail_sender_aliases` table using only a user-supplied `senderid` without verifying if the alias belongs to the authenticated user. By enumerating the global auto-incrementing `senderid` parameter on the delete-confirmation page, an attacker can disclose the `allowed_sender` string of any other customer. While the attacker can view the data, they cannot delete the foreign alias as the final deletion action performs proper ownership revalidation. The issue is fixed in version 2.3.7.

Affected products

• Froxlor Froxlor <= 2.3.6

Timeline

• 2026-05-29: disclosed: Initial disclosure to vendor
• 2026-07-02: advisory: GitHub Advisory published
• 2026-07-02: patched: Version 2.3.7 released

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D