CVE-2026-100710
Deferred Deferred - Pending Action

Froxlor API Information Disclosure via Unfiltered DKIM Private Keys

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin branch of SubDomains::listing() perform a wildcard SELECT over the panel_domains table and return the row unmodified, including the panel_domains.dkim_privkey field. An authenticated, non-superadmin admin holding the delegated customers_see_all flag can therefore read the DKIM private signing keys of domains belonging to other tenants via Domains.get, Domains.listing, SubDomains.get, or SubDomains.listing, with a single listing call disclosing the key of every visible domain. The disclosed keys allow an attacker to sign email that passes DKIM verification and DMARC alignment for the affected domains. This is a follow-on to an incomplete fix that stripped password and data_2fa but not dkim_privkey. The issue is fixed in 2.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100710
EUVD
EUVD-2026-87683

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
froxlor froxlor to 2.3.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor versions before 2.3.12 have an information disclosure vulnerability where authenticated non-superadmin administrators with the delegated customers_see_all privilege can access DKIM private signing keys of domains belonging to other tenants through API calls. The affected API endpoints perform wildcard SELECT queries on the panel_domains table and return sensitive data including the dkim_privkey field.

Detection Guidance

To detect this vulnerability, check if your Froxlor instance is running a version before 2.3.12. Use commands like 'froxlor --version' or inspect the web interface for version details. Verify if non-superadmin admins with the customers_see_all flag can access DKIM private keys via API calls such as Domains::get(), Domains::listing(), SubDomains::get(), or SubDomains::listing().

Test by making API requests with a non-superadmin admin account that has the customers_see_all flag enabled. If the response includes the dkim_privkey field, the system is vulnerable.

Impact Analysis

An attacker could obtain DKIM private keys, enabling them to forge signed emails that pass DKIM verification and DMARC alignment for the affected domains. This could lead to email spoofing, phishing attacks, or unauthorized use of the domain's identity in email communications.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR and HIPAA due to unauthorized access to sensitive cryptographic material. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information, both of which could be compromised by this flaw.

Mitigation Strategies

Immediately upgrade Froxlor to version 2.3.12 or later to patch the vulnerability. Remove the customers_see_all flag from non-superadmin admins until the upgrade is complete. Review API access logs for suspicious activity involving DKIM key exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart