CVE-2026-100710 Details
Description
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12.
A vulnerability exists in Froxlor versions through 2.3.10, where the API endpoints for managing domains and subdomains do not properly filter sensitive information before it is returned in the response. Specifically, the 'dkim_privkey' field, which contains private DKIM signing keys, is exposed through several API commands. This issue affects authenticated, non-superadmin admins who have the 'customers_see_all' delegation flag, allowing them to access DKIM private keys for domains belonging to other tenants. The exposed keys can be used to sign emails, making them appear legitimate under DKIM and DMARC checks. This vulnerability follows a previous one that was only partially addressed, leaving the DKIM private key exposure uncorrected.
Users should update Froxlor to version 2.3.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-79gx-h528-j9xf | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/froxlor-before-2.3.12-dkim-private-key-disclosure-via-api | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Froxlor | <= 2.3.10 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | New CVE Received | [email protected] |