{"affected":[{"conditional":false,"product":"froxlor","source":"NVD","vendor":"froxlor","versions":[{"lessThan":"2.3.6","status":"affected","version":"*","versionType":"custom"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"froxlor/froxlor","product":"froxlor/froxlor","source":"OSV GHSA-vmjj-qr7v-pxm6","vendor":"","versions":[{"status":"affected","version":"0.10.0","versionType":"Packagist"},{"status":"affected","version":"0.10.0-rc1","versionType":"Packagist"},{"status":"affected","version":"0.10.0-rc2","versionType":"Packagist"},{"status":"affected","version":"0.10.1","versionType":"Packagist"},{"status":"affected","version":"0.10.10","versionType":"Packagist"},{"status":"affected","version":"0.10.11","versionType":"Packagist"},{"status":"affected","version":"0.10.12","versionType":"Packagist"},{"status":"affected","version":"0.10.13","versionType":"Packagist"},{"status":"affected","version":"0.10.14","versionType":"Packagist"},{"status":"affected","version":"0.10.15","versionType":"Packagist"},{"status":"affected","version":"0.10.16","versionType":"Packagist"},{"status":"affected","version":"0.10.17","versionType":"Packagist"},{"status":"affected","version":"0.10.18","versionType":"Packagist"},{"status":"affected","version":"0.10.19","versionType":"Packagist"},{"status":"affected","version":"0.10.2","versionType":"Packagist"},{"status":"affected","version":"0.10.20","versionType":"Packagist"},{"status":"affected","version":"0.10.21","versionType":"Packagist"},{"status":"affected","version":"0.10.22","versionType":"Packagist"},{"status":"affected","version":"0.10.23","versionType":"Packagist"},{"status":"affected","version":"0.10.23.1","versionType":"Packagist"},{"status":"affected","version":"0.10.24","versionType":"Packagist"},{"status":"affected","version":"0.10.25","versionType":"Packagist"},{"status":"affected","version":"0.10.26","versionType":"Packagist"},{"status":"affected","version":"0.10.27","versionType":"Packagist"},{"status":"affected","version":"0.10.28","versionType":"Packagist"},{"status":"affected","version":"0.10.29","versionType":"Packagist"},{"status":"affected","version":"0.10.29.1","versionType":"Packagist"},{"status":"affected","version":"0.10.3","versionType":"Packagist"},{"status":"affected","version":"0.10.30","versionType":"Packagist"},{"status":"affected","version":"0.10.31","versionType":"Packagist"},{"status":"affected","version":"0.10.32","versionType":"Packagist"},{"status":"affected","version":"0.10.33","versionType":"Packagist"},{"status":"affected","version":"0.10.34","versionType":"Packagist"},{"status":"affected","version":"0.10.34.1","versionType":"Packagist"},{"status":"affected","version":"0.10.35","versionType":"Packagist"},{"status":"affected","version":"0.10.35.1","versionType":"Packagist"},{"status":"affected","version":"0.10.36","versionType":"Packagist"},{"status":"affected","version":"0.10.37","versionType":"Packagist"},{"status":"affected","version":"0.10.38","versionType":"Packagist"},{"status":"affected","version":"0.10.38.1","versionType":"Packagist"},{"status":"affected","version":"0.10.38.2","versionType":"Packagist"},{"status":"affected","version":"0.10.38.3","versionType":"Packagist"},{"status":"affected","version":"0.10.4","versionType":"Packagist"},{"status":"affected","version":"0.10.5","versionType":"Packagist"},{"status":"affected","version":"0.10.6","versionType":"Packagist"},{"status":"affected","version":"0.10.7","versionType":"Packagist"},{"status":"affected","version":"0.10.8","versionType":"Packagist"},{"status":"affected","version":"0.10.9","versionType":"Packagist"},{"status":"affected","version":"2.0.0","versionType":"Packagist"},{"status":"affected","version":"2.0.1","versionType":"Packagist"},{"status":"affected","version":"2.0.10","versionType":"Packagist"},{"status":"affected","version":"2.0.11","versionType":"Packagist"},{"status":"affected","version":"2.0.12","versionType":"Packagist"},{"status":"affected","version":"2.0.13","versionType":"Packagist"},{"status":"affected","version":"2.0.14","versionType":"Packagist"},{"status":"affected","version":"2.0.15","versionType":"Packagist"},{"status":"affected","version":"2.0.16","versionType":"Packagist"},{"status":"affected","version":"2.0.17","versionType":"Packagist"},{"status":"affected","version":"2.0.18","versionType":"Packagist"},{"status":"affected","version":"2.0.19","versionType":"Packagist"},{"status":"affected","version":"2.0.2","versionType":"Packagist"},{"status":"affected","version":"2.0.20","versionType":"Packagist"},{"status":"affected","version":"2.0.21","versionType":"Packagist"},{"status":"affected","version":"2.0.22","versionType":"Packagist"},{"status":"affected","version":"2.0.23","versionType":"Packagist"},{"status":"affected","version":"2.0.24","versionType":"Packagist"},{"status":"affected","version":"2.0.3","versionType":"Packagist"},{"status":"affected","version":"2.0.4","versionType":"Packagist"},{"status":"affected","version":"2.0.5","versionType":"Packagist"},{"status":"affected","version":"2.0.6","versionType":"Packagist"},{"status":"affected","version":"2.0.7","versionType":"Packagist"},{"status":"affected","version":"2.0.8","versionType":"Packagist"},{"status":"affected","version":"2.0.9","versionType":"Packagist"},{"status":"affected","version":"2.1.0","versionType":"Packagist"},{"status":"affected","version":"2.1.0-beta1","versionType":"Packagist"},{"status":"affected","version":"2.1.0-beta2","versionType":"Packagist"},{"status":"affected","version":"2.1.0-rc1","versionType":"Packagist"},{"status":"affected","version":"2.1.0-rc2","versionType":"Packagist"},{"status":"affected","version":"2.1.0-rc3","versionType":"Packagist"},{"status":"affected","version":"2.1.1","versionType":"Packagist"},{"status":"affected","version":"2.1.2","versionType":"Packagist"},{"status":"affected","version":"2.1.3","versionType":"Packagist"},{"status":"affected","version":"2.1.4","versionType":"Packagist"},{"status":"affected","version":"2.1.5","versionType":"Packagist"},{"status":"affected","version":"2.1.6","versionType":"Packagist"},{"status":"affected","version":"2.1.7","versionType":"Packagist"},{"status":"affected","version":"2.1.8","versionType":"Packagist"},{"status":"affected","version":"2.1.9","versionType":"Packagist"},{"status":"affected","version":"2.2.0","versionType":"Packagist"},{"status":"affected","version":"2.2.0-rc1","versionType":"Packagist"},{"status":"affected","version":"2.2.0-rc2","versionType":"Packagist"},{"status":"affected","version":"2.2.0-rc3","versionType":"Packagist"},{"status":"affected","version":"2.2.1","versionType":"Packagist"},{"status":"affected","version":"2.2.2","versionType":"Packagist"},{"status":"affected","version":"2.2.3","versionType":"Packagist"},{"status":"affected","version":"2.2.4","versionType":"Packagist"},{"status":"affected","version":"2.2.5","versionType":"Packagist"},{"status":"affected","version":"2.2.6","versionType":"Packagist"},{"status":"affected","version":"2.2.7","versionType":"Packagist"},{"status":"affected","version":"2.2.8","versionType":"Packagist"},{"status":"affected","version":"2.3.0","versionType":"Packagist"},{"status":"affected","version":"2.3.0-rc1","versionType":"Packagist"},{"status":"affected","version":"2.3.1","versionType":"Packagist"},{"status":"affected","version":"2.3.2","versionType":"Packagist"},{"status":"affected","version":"2.3.3","versionType":"Packagist"},{"status":"affected","version":"2.3.4","versionType":"Packagist"},{"status":"affected","version":"2.3.5","versionType":"Packagist"},{"events":[{"introduced":"0"},{"fixed":"2.3.6"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.6","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-41232","cwes":["CWE-863"],"description":"Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for full email sender aliases uses the wrong array index when splitting the email address, passing the local part instead of the domain to `validateLocalDomainOwnership()`. This causes the ownership check to always pass for non-existent \"domains,\" allowing any authenticated customer to add sender aliases for email addresses on domains belonging to other customers. Postfix's `sender_login_maps` then authorizes the attacker to send emails as those addresses. Version 2.3.6 fixes the issue.","epss":null,"exploits":[{"kind":"exploit","source":"security-advisories@github.com","url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6"},{"kind":"exploit","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6"}],"kev":null,"metrics":[{"score":5,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794438600263,"publishedAt":1776921365333,"references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07a"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/froxlor/froxlor/releases/tag/2.3.6"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/froxlor/froxlor/security/advisories/GHSA-vmjj-qr7v-pxm6"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-vmjj-qr7v-pxm6"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-vmjj-qr7v-pxm6"}],"remediation":[{"kind":"fix","source":"security-advisories@github.com","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/froxlor/froxlor/commit/77d04badf549d5f8429828f0fbc69bc37a35e07a"},{"kind":"fix","source":"OSV GHSA-vmjj-qr7v-pxm6","text":"froxlor/froxlor (Packagist): OSV reports a fixed version 2.3.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-vmjj-qr7v-pxm6"}],"revision":"9160787273406844cf1563660c136e61bc484142ab461aefd5bae381419d8228","sources":[{"modifiedAt":1794438600263,"name":"NVD","retrievedAt":1794442736989,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41232"},{"modifiedAt":1777998388528,"name":"OSV / GitHub Security Advisories","retrievedAt":1794442738906,"url":"https://osv.dev/vulnerability/GHSA-vmjj-qr7v-pxm6"}],"ssvc":{"assessedAt":1776955769020,"automatable":"no","exploitation":"poc","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2026-41232","updatedAt":1794442738906}