What is the CVSS score of CVE-2026-41232?

CVE-2026-41232 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41232?

Yes, a patch is available for CVE-2026-41232. Update the affected software to the latest version immediately.

Froxlor CVE-2026-41232

EUVD-2026-25186 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-23 GitHub_M

Authentication Bypass Froxlor

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 27, 2026 - 17:02 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 07:08 vuln.today

Patch available

Apr 23, 2026 - 06:16 EUVD

EUVD ID Assigned

Apr 23, 2026 - 05:00 euvd

EUVD-2026-25186

Analysis Generated

Apr 23, 2026 - 05:00 vuln.today

CVE Published

Apr 23, 2026 - 03:54 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

Froxlor is open source server administration software. Prior to version 2.3.6, in EmailSender::add(), the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to validateLocalDomainOwnership(). This causes the ownership check to always pass for non-existent "domains," allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's sender_login_maps then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.

AnalysisAI

Froxlor versions prior to 2.3.6 fail to validate domain ownership correctly when adding full email sender aliases, allowing authenticated customers to add sender aliases for email addresses on domains belonging to other customers and subsequently send emails as those addresses via Postfix sender_login_maps authorization. The vulnerability stems from an array indexing error in EmailSender::add() that passes the local part of an email address instead of the domain to the ownership validation function, causing the check to pass for non-existent domains. No active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exists in the EmailSender::add() method of Froxlor, an open-source server administration platform that manages email services among other hosting features. When processing full email sender aliases (email addresses that users can send from), the code splits an email address into local and domain components but uses an incorrect array index when retrieving the domain portion for validation. Specifically, it passes the local part (everything before the @) to validateLocalDomainOwnership() instead of the domain part (everything after the @). This function is designed to verify that the requesting customer actually owns the domain in question. The error causes the validation to check ownership of non-existent or invalid domain strings, which fail silently and allow the operation to proceed. Postfix's sender_login_maps then trusts this validation and authorizes the attacker to send mail as the spoofed address. The root cause falls under CWE-863 (Incorrect Authorization), as the access control check fails due to improper validation logic rather than a missing check.

RemediationAI

Upgrade to Froxlor version 2.3.6 or later immediately to apply the vendor-released patch, which corrects the array indexing error in EmailSender::add() to properly validate domain ownership. The fix is available from the official Froxlor GitHub repository (https://github.com/froxlor/froxlor/releases/tag/2.3.6) and the commit implementing the correction is available at https://github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07a. No workaround is available for versions prior to 2.3.6; patching is the only remediation. Organizations unable to immediately patch should restrict access to the email sender alias management functionality to trusted administrators only, disable customer self-service email alias creation if that feature exists, and monitor sender_login_maps logs for unexpected sender addresses.