CVE-2026-119049
CVE-2026-119049 · FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
CVSS 7.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
freemail
- Versions
- ≥ 0, < 5.3.2: Affected (semver)
Update to 5.3.2
Original sources
- https://github.com/idinging/freemail/issues/73
- https://github.com/idinging/freemail
- https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1
- https://github.com/idinging/freemail/releases/tag/v5.3.2
- https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163
- https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming
- https://nvd.nist.gov/vuln/detail/CVE-2026-119049