CVE-2026-90936: Froxlor Information Disclosure Vulnerability

CVE-2026-90936 Overview

CVE-2026-90936 is an information disclosure vulnerability in Froxlor, an open-source server administration panel. Versions before 2.3.7 fail to properly scope sender alias lookups to the current customer within customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any authenticated Froxlor customer can enumerate and read email sender alias data belonging to other tenants on the same panel, breaking multi-tenant isolation.

Affected Products

Froxlor versions before 2.3.7
Froxlor customer email management module (customer_email.php)
Multi-tenant Froxlor deployments hosting more than one customer account

Discovery Timeline

2026-09-14 - CVE-2026-90936 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90936

Vulnerability Analysis

Froxlor exposes email management functions to authenticated customers through customer_email.php. When a customer initiates a delete action for a sender alias, the application accepts a senderid parameter identifying the target record. The delete confirmation flow retrieves the alias record and renders its value back to the requester before the deletion is confirmed.

The underlying query resolves the alias by its numeric identifier without constraining the lookup to records owned by the requesting customer. As a result, the confirmation view discloses sender alias data associated with any senderid value the attacker supplies. This violates the tenant isolation model that a shared hosting panel is expected to enforce.

Root Cause

The root cause is a missing authorization check on the alias lookup query. The code path that handles the delete confirmation trusts the senderid parameter without joining or filtering on the authenticated customer's identifier. This is a classic Insecure Direct Object Reference (IDOR) pattern, mapped to [CWE-200] for the resulting sensitive data exposure.

Attack Vector

An attacker who holds valid credentials for any customer account on a Froxlor instance can iterate through senderid values in requests to the delete confirmation endpoint. Each response reveals the allowed sender value tied to that identifier, allowing systematic enumeration of email aliases belonging to other customers. No elevated privileges or user interaction are required beyond authenticated access.

See the GitHub Security Advisory GHSA-mr9h-45p9-fg8h and the VulnCheck Advisory on Froxlor for additional technical context.

Detection Methods for CVE-2026-90936

Indicators of Compromise

Repeated HTTP requests from a single authenticated session to customer_email.php with sequentially incrementing senderid values.
Access patterns where one customer account queries senderid values outside the range of aliases it legitimately owns.
Unusual spikes in delete confirmation requests without corresponding delete completion actions.

Detection Strategies

Review Froxlor web server access logs for enumeration patterns against customer_email.php and correlate senderid values with the authenticated customer's owned records.
Enable database query auditing to identify sender alias SELECT statements not scoped by a customer identifier.
Alert on any authenticated user retrieving more than a defined threshold of unique senderid records within a short window.

Monitoring Recommendations

Forward Froxlor and web server access logs to a centralized analytics platform for cross-tenant behavioral analysis.
Track per-customer baselines for email management activity and flag deviations that suggest enumeration.
Monitor authentication logs for accounts that access the panel and immediately begin scanning parameter values.

How to Mitigate CVE-2026-90936

Immediate Actions Required

Upgrade Froxlor to version 2.3.7 or later on all instances hosting more than one customer.
Audit historical web server logs for evidence of senderid enumeration prior to the upgrade.
Rotate or review any email sender aliases that may have been exposed to unauthorized customers.

Patch Information

The issue is fixed in Froxlor 2.3.7. The upstream patch scopes the sender alias lookup in customer_email.php to the authenticated customer, preventing cross-tenant retrieval. Refer to the GitHub Security Advisory GHSA-mr9h-45p9-fg8h for the fixed commit and release notes.

Workarounds

Restrict customer panel access to trusted operators until the upgrade to 2.3.7 is completed.
Apply web application firewall rules that block requests where senderid values do not match the requesting session's known aliases.
Temporarily disable the customer email management feature in shared environments if upgrading is not immediately possible.

bash

# Upgrade Froxlor to the fixed release
cd /var/www/froxlor
git fetch --tags
git checkout 2.3.7
php install/updatesql.php