CVE-2026-100710: Froxlor API Information Disclosure Flaw

CVE-2026-100710 is an information disclosure flaw in Froxlor API that exposes DKIM private keys through unfiltered responses. Authenticated admins can access signing keys of other tenants' domains. This article covers technical details, affected versions through 2.3.10, impact on email security, and mitigation steps.

CVE-2026-100710 Overview

CVE-2026-100710 is an information disclosure vulnerability in Froxlor through version 2.3.10. The flaw allows authenticated, non-superadmin administrators holding the delegated customers_see_all flag to read DomainKeys Identified Mail (DKIM) private signing keys belonging to other tenants. The affected API methods Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return rows unmodified, including the panel_domains.dkim_privkey field. The issue is fixed in Froxlor 2.3.12. It categorizes under [CWE-200] Information Exposure.

Critical Impact
Disclosed DKIM private keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for affected domains, enabling cross-tenant email spoofing.

Affected Products

Froxlor versions prior to 2.3.12
Froxlor 2.3.10 (confirmed vulnerable per advisory)
Multi-tenant Froxlor deployments where delegated admins hold the customers_see_all flag

Discovery Timeline

2026-09-26 - CVE-2026-100710 published to the National Vulnerability Database
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-100710

Vulnerability Analysis

Froxlor exposes a JSON API that includes domain-management endpoints for administrators. The vulnerable methods Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() issue a wildcard SELECT against the panel_domains table. The resulting row is serialized back to the API caller without column filtering.

The panel_domains table stores each domain's DKIM private signing key in the dkim_privkey column. Because the response is not sanitized, any administrator permitted to call these methods receives the full row, including the private key. A single Domains.listing request returns the DKIM keys for every domain visible to the caller.

This is a follow-on to an earlier, incomplete fix that stripped the password and data_2fa columns from the same responses but failed to also strip dkim_privkey.

Root Cause

The root cause is missing output filtering on sensitive database columns. The affected methods trust the storage layer to decide what is safe to return, rather than applying an explicit allowlist of fields appropriate for the API response context. Secrets stored alongside non-sensitive domain metadata are therefore exposed whenever the row is returned.

Attack Vector

Exploitation requires an authenticated non-superadmin admin account that holds the delegated customers_see_all flag. Over the network, the attacker calls Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing and parses the dkim_privkey field from each returned row. The attacker can then use the harvested private keys to craft and sign email that passes DKIM verification and DMARC alignment for the targeted domains, enabling convincing spoofed mail from other tenants.

See the GitHub Security Advisory GHSA-79gx-h528-j9xf and the VulnCheck Froxlor DKIM Disclosure Advisory for technical references.

Detection Methods for CVE-2026-100710

Indicators of Compromise

API access logs showing authenticated calls to Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing by non-superadmin accounts with the customers_see_all flag.
Unusually large JSON responses from the Froxlor API containing the dkim_privkey field.
Inbound email from unexpected sources that nonetheless passes DKIM and DMARC for a tenant domain hosted on the Froxlor panel.

Detection Strategies

Review Froxlor API logs for the four affected method names and correlate caller identity with admin role assignments.
Audit all admin accounts carrying the customers_see_all flag and verify that each assignment is still required.
Monitor the Froxlor web server for listing calls that return response bodies significantly larger than historical baselines.

Monitoring Recommendations

Centralize Froxlor web and application logs in a SIEM and alert on API calls to the four vulnerable methods by non-superadmin principals.
Track DKIM authentication results in inbound and outbound mail logs to detect unexpected signing activity for tenant domains.
Alert on any read access to the panel_domains.dkim_privkey column at the database layer.

How to Mitigate CVE-2026-100710

Immediate Actions Required

Upgrade Froxlor to version 2.3.12 or later, which strips dkim_privkey from the affected API responses.
Rotate DKIM keys for every domain that was reachable via the affected API endpoints and republish the new public keys in DNS.
Review and reduce the number of delegated admin accounts holding the customers_see_all flag.

Patch Information

The vulnerability is fixed in Froxlor 2.3.12. The upstream patch extends the prior column-filtering fix (which previously stripped only password and data_2fa) to also exclude dkim_privkey from the affected Domains and SubDomains API responses. Refer to the GitHub Security Advisory GHSA-79gx-h528-j9xf for release details.

Workarounds

Revoke the customers_see_all flag from all non-superadmin administrators until the upgrade is applied.
Restrict network access to the Froxlor API to trusted management hosts only.
Rotate DKIM keys and publish the new public keys in DNS before and after upgrading if cross-tenant exposure is suspected.

bash

# Configuration example
# Upgrade Froxlor to the fixed release
sudo apt-get update && sudo apt-get install --only-upgrade froxlor
# Or, for git-based installs:
cd /var/www/froxlor && git fetch --tags && git checkout 2.3.12