A flaw in Froxlor’s EmailSender::add() splits an email address incorrectly, sending the local part instead of the domain to the ownership validation routine. This causes the ownership check to always succeed for arbitrary domains, enabling any authenticated customer to create sender aliases that claim email addresses belonging to other customers. Postfix then authorizes these aliases through sender_login_maps, allowing forged messages to be sent as other users.

All installations of Froxlor older than version 2.3.6 that allow authenticated users to add sender aliases and that use Postfix with sender_login_maps enabled.

The vulnerability has a moderate CVSS score of 5 and an EPSS probability of less than 1 %, and it is not listed in the CISA KEV catalog. Exploitation requires only authentication to the Froxlor web interface; no special privileges are needed. An attacker can craft arbitrary domain aliases, bypassing domain ownership checks and sending spoofed emails. The risk is heightened if the environment trusts Postfix to send outbound mail for all customers without additional access controls.