CVE-2026-100718

Executive Summary

CVE-2026-100718 is an authorization/policy-enforcement flaw in Froxlor (through 2.3.10) in which the EmailSender.add API command does not honor the administrator-configured mail.allow_external_domains policy. When an administrator enables the allowed-sender feature but disables external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still register an arbitrary external sender address for their mailbox. Impact is a policy bypass enabling sender spoofing and weakening anti-spoofing posture for hosting providers running multi-tenant Froxlor installations.

Technical Analysis

Froxlor is a server management panel commonly used by shared-hosting providers to manage mail, web, DNS, and customer accounts. Administrators can govern which sender identities a mailbox owner is permitted to use via the allowed-sender feature. Two configuration flags are relevant per the NVD description:

• mail.enable_allow_sender = 1 — enables the allowed-sender mechanism.
• mail.allow_external_domains = 0 — restricts allowed senders to domains hosted within the panel; external (non-hosted) sender domains are disallowed.

The flaw is classified as CWE-276 (Incorrect Default Permissions) — more precisely a missing/inconsistent authorization check. The UI/administrator layer enforces the intended policy, but the API command EmailSender.add does not. An authenticated customer holding API credentials can therefore submit a sender address whose domain is external to the panel's hosted domains, and the record is persisted in the allowed-sender table despite the policy. Because the generated mail configuration consumes that same allowed-sender table, the accepted (policy-violating) entry becomes operationally effective for outbound mail authorization.

The root cause per the description is a bypass between the UI/administrator configuration and the API: enforcement exists at one entry point (UI) but not at the other (API). This is a classic split-brain authorization defect — the effective security decision (which sender identities are permitted) is derived from a table that the API writes to without re-validating the governing policy flags.

Note on specificity: the NVD description names only the EmailSender.add command and the two configuration keys. No source file paths, class names, method signatures, or HTTP endpoints are provided, so those are deliberately not asserted here. The description does not state whether exploitation requires the mail.enable_allow_sender flag to be on (it does so implicitly, since the policy only becomes relevant when the feature is enabled). The vulnerability is network-accessible (AV:N), low complexity (AC:L), and requires low privileges (PR:L) — an existing customer account with API access. Confidentiality impact is Low; Integrity impact is High (a policy-enforcement control is defeated and spoofable sender identity is authorized); Availability impact is None.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (authorization bypass via API missing a policy check) and the facts in the NVD description. No function names, endpoints, or parameters beyond those in the description are assumed.

1. Reconnaissance / target identification. The attacker identifies a Froxlor instance (through 2.3.10) used as a hosting panel. Relevant to the attack is whether the instance runs the allowed-sender feature with external domains disabled — i.e., mail.enable_allow_sender = 1 and mail.allow_external_domains = 0. This posture is beneficial to the attacker because the administrator believes external sender identities are blocked.

2. Prerequisite — authenticated API access. The attacker must hold a Froxlor customer account that has API access. This is a low-privilege position (CVSS PR:L), consistent with a hosted customer rather than an administrator.

3. Triggering the flaw class. Using the API, the attacker invokes the EmailSender.add command for a mailbox under their control and supplies a sender address whose domain is external to the hosted domains. Because EmailSender.add does not enforce mail.allow_external_domains, the input passes the API layer even though the equivalent UI path would reject it. The policy-violating entry is stored in the allowed-sender table.

4. Effect / post-exploitation. Where the generated mail configuration consumes the allowed-sender table, the stored external sender identity is authorized for the mailbox. The attacker can then send mail using a sender identity outside their hosted domain — a sender-spoofing capability that undermines the provider's anti-abuse controls and can be used for phishing or brand impersonation. The attack does not grant code execution, privilege escalation to admin, or data exfiltration per the described mechanism; its impact is the defeat of an authorization policy and the enablement of spoofed sender identities.

Impact Assessment

CVSS v3.1 base score: 7.1 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.

• Attack Vector (Network): exploit is performed remotely via the panel's API.
• Attack Complexity (Low): no special conditions beyond the target's configuration and a valid account.
• Privileges Required (Low): an authenticated customer with API access suffices.
• User Interaction (None): no victim action required.
• Scope (Unchanged): impact remains within the affected component's security authority.
• Confidentiality (Low): limited downstream exposure from spoofed-identity mail.
• Integrity (High): the allowed-sender policy is defeated and an unauthorized sender identity is persisted and honored.
• Availability (None).

Blast radius and business impact. The most affected parties are hosting providers and any organization running multi-tenant Froxlor with the allowed-sender feature enabled and external sender domains disabled. The primary risk is sender spoofing: a customer can authorize outbound sender identities outside the domains the provider hosts, harming the provider's sending reputation, deliverability, and anti-abuse posture, and enabling phishing or brand impersonation. Because the affected table feeds generated mail configuration, the weakness can be operational rather than merely cosmetic. The configuration preconditions limit impact for deployments that never enable the allowed-sender feature or that permit external domains anyway.

Detection Guidance

Sigma Rule

title: Froxlor EmailSender.add External Sender Policy Bypass (CVE-2026-100718)
id: 7f3c9a1e-2b64-4d0e-9c1a-frox100718a1
status: experimental
description: Detects API calls adding an allowed sender whose domain is outside hosted domains while mail.allow_external_domains is disabled in Froxlor before 2.3.12.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100718
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: froxlor
detection:
  selection_endpoint:
    cs-uri-query|contains: 'EmailSender.add'
  selection_sender:
    cs-uri-query|contains: 'sender'
  filter_internal_domain:
    cs-uri-query|contains:
      - '@customer.example.com'
  condition: selection_endpoint and selection_sender and not filter_internal_domain
fields:
  - c-ip
  - cs-uri-query
  - cs-username
level: medium
falsepositives:
  - Legitimate registrations of external sender addresses when policy is disabled by design.

YARA Rule

rule CVE_2026_100718_Froxlor_EmailSender_PolicyBypass
{
    meta:
        description = "Detects Froxlor code or log artifacts referencing EmailSender.add without mail.allow_external_domains enforcement (CVE-2026-100718)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100718"
        date = "2026-01-01"
        severity = "high"
    strings:
        $cmd   = "EmailSender.add"
        $cfg1  = "mail.allow_external_domains"
        $cfg2  = "mail.enable_allow_sender"
        $tbl   = "allowed-sender"
    condition:
        $cmd and (any of ($cfg*)) and #cmd < 20
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100718 Froxlor EmailSender.add sender policy bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"EmailSender"; http.uri; content:"add"; http.client_body; content:"sender"; content:"@"; pcre:"/@(?!.*\.your-hosting-domain\.tld)/Ri"; classtype:attempted-admin; reference:cve,2026-100718; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100718; sid:9000718; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      stringContains(http.request.body, "EmailSender.add") ]
  [ network where network.protocol == "http" and
      stringContains(url.query, "EmailSender") and
      stringContains(url.query, "add") and
      stringContains(url.query, "sender") ]

Splunk SPL Query

index=web sourcetype=froxlor OR sourcetype=access_combined
| search uri_query="*EmailSender.add*" OR uri_query="*EmailSender*add*"
| rex field=uri_query "(?<sender_addr>[^&]*@[^&]*)"
| where isnotnull(sender_addr)
| eval ext_domain=mvindex(split(sender_addr,"@"),1)
| where NOT match(ext_domain, "(?i)your-hosting-domain\.tld$")
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, sender_addr
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="froxlor,web,cve-2026-100718,">
  <rule id="100718" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>EmailSender|add</url>
    <regex>EmailSender.*add</regex>
    <description>CVE-2026-100718: Froxlor EmailSender.add external sender policy bypass attempt detected</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict API access for customer accounts that do not strictly require it; the attack requires an authenticated customer with API access (PR:L).
   • Where feasible, disable the allowed-sender feature (mail.enable_allow_sender = 0) so that sender identities cannot be authorized via the affected table, or operate with policy configured so external sender identities are not meaningful.
   • Monitor the allowed-sender table for entries whose domains fall outside hosted domains, and alert on additions made through the API. Review for unexpected external sender identities.
   • Audit outbound mail for sender identities outside hosted domains, since the stored entry can feed generated mail configuration.

2. Patch / upgrade steps.

   • NVD states the issue is Fixed in 2.3.12. Upgrade Froxlor from any version through 2.3.10 to 2.3.12 or later. This is a stated fix version from the CVE record; no vendor commit, advisory URL, or release artifact is provided in the supplied data, so validate release availability directly with the Froxlor project before deploying.
   • After upgrade, confirm that EmailSender.add enforces mail.allow_external_domains and that previously inserted policy-violating entries are remediated.

3. Long-term hardening.

   • Enforce authorization policy centrally, so security-relevant checks (such as the allowed-sender policy) are applied uniformly across all entry points — UI, API, and any batch/automation interfaces — rather than only in the UI path.
   • Add automated tests that assert policy-flag combinations (e.g., mail.enable_allow_sender = 1 with mail.allow_external_domains = 0) are honored identically via every interface.
   • Apply least privilege to API credentials and monitor for anomalies in sender-identity registration.
   • Maintain SPF/DKIM/DMARC controls so that even authorized external sender identities cannot fully bypass domain authentication.

References

• NVD — CVE-2026-100718: https://nvd.nist.gov/vuln/detail/CVE-2026-100718
• CWE-276: Incorrect Default Permissions — https://cwe.mitre.org/data/definitions/276.html
• Froxlor project (vendor) — verify 2.3.12 release notes/advisory for CVE-2026-100718: https://froxlor.org/
• FIRST EPSS (no score available at time of writing; monitor for updates): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100718 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available. No threat-actor campaign or exploit-in-the-wild evidence is reported in the supplied data; CISA KEV status is NO.