Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. (CVE-2026-100718)
Froxlor versions up to 2.3.10 have a vulnerability where the mail.allow_external_domains policy is not enforced in the EmailSender.add API command. This allows an authenticated customer with API access to register arbitrary external sender addresses despite policy settings that should prevent this. The issue creates a bypass between the administrator UI configuration and the API, enabling sender spoofing by authorizing sender identities outside the hosted domains. The vulnerability is fixed in version 2.3.12.
AI Analysis
Technical Summary
Froxlor through version 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When the allowed-sender feature is enabled but external allowed-sender domains are disabled (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still register arbitrary external sender addresses for their mailbox. This bypasses the UI/administrator configuration and allows sender spoofing by authorizing sender identities outside the hosted domains. The issue is resolved in Froxlor 2.3.12.
Potential Impact
An authenticated customer with API access can bypass administrator policy restrictions to register external sender addresses, enabling sender spoofing. This can lead to unauthorized use of sender identities outside the hosted domains, potentially undermining email trust and security. The impact includes low confidentiality loss but high integrity impact due to spoofed sender identities. Availability is not affected.
Mitigation Recommendations
Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. No other mitigation is indicated as the fix addresses the policy enforcement bypass.
Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. (CVE-2026-100718)
Description
Froxlor versions up to 2.3.10 have a vulnerability where the mail.allow_external_domains policy is not enforced in the EmailSender.add API command. This allows an authenticated customer with API access to register arbitrary external sender addresses despite policy settings that should prevent this. The issue creates a bypass between the administrator UI configuration and the API, enabling sender spoofing by authorizing sender identities outside the hosted domains. The vulnerability is fixed in version 2.3.12.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Froxlor through version 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When the allowed-sender feature is enabled but external allowed-sender domains are disabled (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still register arbitrary external sender addresses for their mailbox. This bypasses the UI/administrator configuration and allows sender spoofing by authorizing sender identities outside the hosted domains. The issue is resolved in Froxlor 2.3.12.
Potential Impact
An authenticated customer with API access can bypass administrator policy restrictions to register external sender addresses, enabling sender spoofing. This can lead to unauthorized use of sender identities outside the hosted domains, potentially undermining email trust and security. The impact includes low confidentiality loss but high integrity impact due to spoofed sender identities. Availability is not affected.
Mitigation Recommendations
Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. No other mitigation is indicated as the fix addresses the policy enforcement bypass.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m5mc-84wm-h4mw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100718"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89bd7f7a7c54106941ff3
Added to database: 09/27/2026, 04:30:15 UTC
Last enriched: 09/27/2026, 04:40:43 UTC
Last updated: 09/28/2026, 01:47:40 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.