CVE-2026-100710

Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12.

• CWE-200

• https://github.com/froxlor/froxlor/security/advisories/GHSA-79gx-h528-j9xf
• https://www.vulncheck.com/advisories/froxlor-before-2.3.12-dkim-private-key-disclosure-via-api

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100705Kyverno before 1.19.1 is vulnerable to server-side request f…7.6
• CVE-2026-100706kyverno before 1.19.1 fails to properly validate URL-encoded…9.9
• CVE-2026-100707Kyverno before 1.19.1 contains a namespace isolation bypass …7.7
• CVE-2026-100708Froxlor before 2.3.13 returns the ssl_key_file column — whic…7.1
• CVE-2026-100709Froxlor through 2.3.10 stores only a numeric user ID in reme…7.5
• CVE-2026-10071DreamMaker developed by Interinfo has an Arbitrary File Uplo…9.8
• CVE-2026-100711froxlor versions before 2.3.12 fail to invalidate existing p…7.5
• CVE-2026-100712froxlor through 2.3.10 disables a user's two-factor authenti…6.5
• CVE-2026-100713Froxlor 2.3.10 and earlier contain a time-of-check time-of-u…7.8
• CVE-2026-100714Froxlor before 2.3.12 does not restrict or escape the system…9.1
• CVE-2026-100715Froxlor through 2.3.10 is vulnerable to arbitrary file delet…9.6
• CVE-2026-100716Froxlor is a server administration panel. In versions 2.3.10…9.9