Froxlor through version 2.3.10 does not properly filter sensitive columns from API responses in the Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() methods. These methods perform a wildcard SELECT on the panel_domains table and return all columns unmodified, including the dkim_privkey field. An authenticated admin user with the delegated customers_see_all flag but without superadmin privileges can retrieve the DKIM private keys of domains belonging to other tenants. This vulnerability is a follow-up to a previous incomplete fix that removed password and data_2fa fields but not dkim_privkey. The vulnerability is resolved in Froxlor version 2.3.12.

An attacker with authenticated admin access and the delegated customers_see_all flag can obtain DKIM private keys of other tenants' domains. This could allow the attacker to sign emails that appear legitimate by passing DKIM verification and DMARC alignment, potentially facilitating email spoofing or phishing attacks. The CVSS score is 4.9 (medium severity), reflecting the confidentiality impact without integrity or availability impact.

Upgrade Froxlor to version 2.3.12 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Since this is not a cloud service, remediation depends on applying the official patch.