Froxlor versions up to and including 2.3.10 fail to filter the dkim_privkey column from API responses for several domain‑related endpoints. An authenticated administrator who is not a superadmin but holds the delegated customers_see_all flag can request domain or subdomain information and receive a complete table row, thereby disclosing the private key used to sign DKIM emails for all visible domains. Possession of this key allows the attacker to forge DKIM signatures that will pass both DKIM verification and DMARC alignment, making malicious mail appear legitimate.

All installations of Froxlor that are 2.3.10 or older are vulnerable. The issue was addressed in release 2.3.12; any deployment still using the older releases remains at risk. The affected API calls are Domains::get, Domains::listing, SubDomains::get, and the admin branch of SubDomains::listing.

The CVSS base score of 6.9 indicates a moderate severity for information disclosure. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack requires authenticated access via the API and the ability to set the delegated customers_see_all flag, which is typically granted to non‑superadmin administrators with customer‑management privileges. Once the key is obtained, an attacker can produce convincing DKIM‑signed emails that satisfy recipient mail servers’ DNS‑based authentication checks, thereby enabling phishing or other spoofing campaigns.