CVE-2026-90936CWE-200information-disclosure

CVE-2026-90936

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-14T17:19Z
References (3)
https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h · [email protected]https://www.vulncheck.com/advisories/froxlor-before-2.3.7-information-disclosure-via-customer-email-php · [email protected]https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:48Z
    Froxlor before 2.3.7 Information Disclosure via customer_email.php
    cvelistv5