In Froxlor versions before 2.3.7, when mail.enable_allow_sender is enabled, the customer_email.php script loads allowed sender aliases by a global auto-increment senderid without verifying ownership. Since mail_sender_aliases.id is a global primary key, an authenticated user can enumerate senderid values and cause Froxlor to display allowed sender aliases belonging to other customers on the delete confirmation page. Although the attacker cannot delete foreign aliases due to ownership checks during deletion, this flaw leads to cross-tenant information disclosure of allowed sender aliases.

An authenticated customer can enumerate and read allowed sender aliases belonging to other customers, resulting in cross-tenant information disclosure. The vulnerability does not allow modification or deletion of other customers' sender aliases, nor does it affect system availability.

Scope the sender alias lookup to the current customer and mailbox before rendering the confirmation page. The confirmation flow should use the same ownership verification as the EmailSender::delete() function. Since the affected versions are prior to 2.3.7, upgrading to version 2.3.7 or later (once available) is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.