Live › vulnerability › CVE-2026-119049
FreeMail before 5.3.2 lets any logged-in user claim an existing mailbox belonging to another user through the POST /api/create endpoint. The attacker can then read that person's mail and verification codes, set forwarding, and delete messages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Any deployment of FreeMail before 5.3.2 where users can authenticate, since the flaw needs only a normal account plus knowledge of a victim's mailbox address. Deployments where registration and mailbox creation are restricted to administrators are less exposed, though the sources do not state this. Self-hosted mail instances are the main concern.
No product ranges from the sources yet.
5.3.2/api/create endpoint and whether it accepts an existing mailbox address for a non-owner account5.3.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
This page as .md · .json · in your agent: get_signal("CVE-2026-119049")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.