https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:10:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41232 <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to `validateLocalDomainOwnership()`. This causes the ownership check to always pass for non-existent &#34;domains,&#34; allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix&#39;s `sender_login_maps` then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.</p> <p><strong>Affected:</strong> froxlor</p> <p>Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to `validateLocalDomainOwnership()`. This causes the ownership check to always pass for non-existent &#34;domains,&#34; allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix&#39;s `sender_login_maps` then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-41232