GHSA-mr9h-45p9-fg8h: Froxlor: Authenticated customers can read other customers' allowed sender aliases

An authenticated customer can read other customers’ allowed sender aliases from Froxlor’s sender-delete confirmation page when mail.enable_allow_sender is enabled. customer_email.php loads allowed_sender by global auto-increment senderid alone, so a customer can enumerate foreign sender alias IDs and make Froxlor disclose those values in the confirmation dialog for the attacker’s own mailbox.