{"id":"CVE-2026-119049","title":"FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming","summary":"FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners t…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"idinging","product":"FreeMail","affected":["FreeMail < 5.3.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T14:02:16.305255Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T14:02:26.966Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119049","references":[{"url":"https://github.com/idinging/freemail/issues/73","label":"GitHub Issue #73"},{"url":"https://github.com/idinging/freemail"},{"url":"https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1"},{"url":"https://github.com/idinging/freemail/releases/tag/v5.3.2","label":"FreeMail v5.3.2 Release Notes"},{"url":"https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163"},{"url":"https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming","label":"VulnCheck Advisory: FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming"}],"tags":["cve.org"],"epss":0.00386,"epssPercentile":0.32796,"ingestedAt":"2026-11-01T20:00:16.930Z","slug":"CVE-2026-119049","body":"## Overview\n\nFreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.\n\n## Affected\n\n- `FreeMail < 5.3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}