Is CVE-2026-90936 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90936?

CVE-2026-90936 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-90936

Description

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.