Froxlor does not enforce the mail.allow_external_domains policy when an API call to EmailSender.add is made. Even when the administrator enables allowed-sender functionality but blocks external domains, an authenticated customer can register arbitrary external sender addresses for their mailbox. The stored addresses are then usable by the mail system, creating a secret channel that bypasses UI configuration and allows a customer to own sender identities outside the domains they host, thereby enabling spoofing of outbound mail.

The affected vendor is Froxlor. All installations of Froxlor up through version 2.3.10 are vulnerable, and the issue is resolved in version 2.3.12. The vulnerability applies to any deployment that has the allowed-sender feature enabled while disallowing external domains.

The CVSS rating of 7.1 reflects a moderate‑to‑high impact for authenticated users. Because the attack requires a valid API credential, the likelihood of exploitation is limited to legitimate API users or compromised accounts, but it remains feasible without additional privileges. The EPSS is not available, and the vulnerability is not reported in CISA’s KEV catalog. Attackers can abuse the API to register external addresses, resulting in malicious spam or phishing that appears to come from legitimate customer domains. The risk is mitigated by applying the vendor’s patch or disabling the external‑sender allowance so no such addresses can be recorded.