{"action":"Upgrade froxlor/froxlor to 2.3.7 or later.","affected":[{"fixed":"2.3.7","introduced":"0"}],"component":"froxlor/froxlor","cve_ids":["CVE-2026-90936"],"ecosystem":"Packagist","epss":0.00306,"exploited":false,"fixed_versions":["2.3.7"],"ghsa_id":"GHSA-mr9h-45p9-fg8h","id":"tcs_01M5KF5SSY7D50ZFQF3DS7WV8V","modified_at":"2026-09-15T03:56:01.561051532Z","published_at":"2026-07-02T19:23:31Z","references":["https://osv.dev/vulnerability/GHSA-mr9h-45p9-fg8h","https://github.com/froxlor/froxlor/security/advisories/GHSA-mr9h-45p9-fg8h","https://github.com/froxlor/froxlor"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-mr9h-45p9-fg8h","url":"https://osv.dev/vulnerability/GHSA-mr9h-45p9-fg8h"}],"summary":"Froxlor: Authenticated customers can read other customers' allowed sender aliases"}