CVE-2026-100718

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.

• CWE-276

• https://github.com/froxlor/froxlor/security/advisories/GHSA-m9j6-9856-68xf
• https://www.vulncheck.com/advisories/froxlor-before-2.3.12-authentication-bypass-via-emailsender-add

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100712froxlor through 2.3.10 disables a user's two-factor authenti…6.5
• CVE-2026-100713Froxlor 2.3.10 and earlier contain a time-of-check time-of-u…7.8
• CVE-2026-100714Froxlor before 2.3.12 does not restrict or escape the system…9.1
• CVE-2026-100715Froxlor through 2.3.10 is vulnerable to arbitrary file delet…9.6
• CVE-2026-100716Froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100717froxlor is a server administration panel. In versions 2.3.10…9.9
• CVE-2026-100719Froxlor versions before 2.3.12 contain a credential disclosu…6.5
• CVE-2026-10072DreamMaker developed by Interinfo has an Arbitrary File Uplo…8.6
• CVE-2026-100720Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-s…8.7
• CVE-2026-10073DreamMaker developed by Interinfo has an Arbitrary File Read…8.7
• CVE-2026-100739A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-10074DreamMaker developed by Interinfo has an Arbitrary File Read…6.9