Authorization bypass in FreeMail lets users claim other users' mailboxes
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
FreeMail before 5.3.2 contains an authorization bypass that lets authenticated users claim another user's existing mailbox through the POST /api/create endpoint. An attacker who knows a victim's address can become a co-owner through assignMailboxToUser, allowing them to read messages and verification codes, set forwarding, and delete mail. The flaw is classified as CWE-639, authorization bypass through a user-controlled key, and exploitation requires low privileges and no user interaction over the network.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update FreeMail to version 5.3.2 or later, which fixes the issue. The sources list no advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA FreeMail (idinging) Fixed in 5.3.2
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119049
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
- 2026-10-29 Alias added: GHSA-7mjv-78r5-wjqw
References
Sources
- CVE-2026-119049 · CVE Program
- CVE-2026-119049 · NVD
- FIRST EPSS
- GHSA-7mjv-78r5-wjqw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences