Froxlor EUVD-2026-25186

Exploitation requires a valid authenticated customer account on a Froxlor instance with email sender alias functionality enabled (standard configuration). The attacker must have access to the email alias management interface, which is typically available to all customers in the hosting control panel. The vulnerability affects any domain that is not owned by the attacker's account-meaning an attacker with one customer account can spoof sender addresses on domains belonging to other customers within the same Froxlor installation. No special network configuration, non-default settings, or user interaction is required beyond authentication and accessing the alias management feature. The vulnerability is limited by the PR:L requirement (authenticated customer account must exist) and the scope constraint (integrity impact is limited to email sender identity within the customer's administrative boundary, not system-wide compromise).

This vulnerability presents moderate real-world risk despite the 5.0 CVSS score, which reflects its limited scope (same administrative domain only, not cross-system). The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) accurately describes the attack: network-accessible, no complexity, requires low privilege (authenticated customer account), no user interaction, and impacts integrity of email sender identity across the customer's administrative scope. The low integrity impact (I:L) is somewhat understated-spoofing email sender addresses is a significant integrity breach that can facilitate social engineering, fraud, and credential theft, but CVSS correctly reflects that it does not directly compromise confidentiality or availability. The PR:L requirement (authenticated customer) is the key limiting factor; this is not an unauthenticated remote code execution. Real-world risk depends on deployment type: shared hosting providers with many customer accounts face elevated risk, while single-tenant or private deployments have minimal exposure. The vulnerability is straightforward to exploit once authenticated-no special complexity-and affects all versions before 2.3.6. No EPSS data, KEV listing, or public proof-of-concept code was provided, suggesting limited real-world exploitation to date, though the simplicity of the attack means weaponization is trivial if discovered.

A malicious customer on a shared Froxlor-managed hosting platform authenticates to their account and navigates to the email sender alias management interface. They attempt to add a sender alias for user@competitor.com, a domain belonging to a different customer. Due to the array indexing bug, the domain ownership validation checks whether the local part 'user' exists as a domain (which it does not), and the check silently passes. The attacker can now send emails from user@competitor.com, potentially conducting phishing attacks, invoice fraud, or credential theft against recipients who trust the spoofed address.