CVE-2026-119049 in FreeMail
Summary
by MITRE • 10/29/2026
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw resides in FreeMail versions prior to 5.3.2 and represents a critical authorization bypass vulnerability within the application logic governing mailbox ownership and assignment. This specific weakness allows authenticated users to manipulate the system's state by claiming another user's existing mailbox through improper validation of access controls on the POST /api/create endpoint. The core technical failure lies in the insufficient verification of whether the requesting user has legitimate administrative privileges or explicit permission to assign mailboxes belonging to other entities. Instead of strictly validating that the action is authorized for the specific target mailbox, the application relies on flawed logic that permits an authenticated actor to invoke the assignMailboxToUser function with arbitrary parameters, effectively transferring ownership rights without proper authorization checks.
From a technical perspective, this vulnerability exploits the lack of object-level access control mechanisms when handling user-specific resources. When an attacker provides the email address of a victim they know about, the backend processes the request and assigns mailbox privileges to the requester rather than validating that such a transfer is permitted by system policy or administrator consent. This bypasses standard authentication measures because the user is already logged in; however, it fails at the authorization layer where identity does not equate to permission for all actions within the application scope. The vulnerability aligns with CWE-284 Improper Access Control and specifically reflects issues related to insufficient verification of dynamic data references, which are common in web applications that fail to enforce strict ownership constraints on user-managed resources.
The operational impact of this flaw is severe due to the sensitive nature of email communications. Once an attacker successfully claims a victim's mailbox as a co-owner or primary administrator, they gain comprehensive control over the inbox contents and configuration settings. This includes the ability to read private messages, intercept verification codes used for multi-factor authentication on other services linked to that email address, modify forwarding rules to redirect future correspondence, and delete existing mail to cover tracks or cause data loss. The compromise of verification codes is particularly dangerous as it can lead to account takeovers across multiple platforms where the compromised email serves as a recovery mechanism, thereby amplifying the initial breach into a broader identity theft scenario.
This behavior maps directly to several techniques within the MITRE ATT&CK framework for enterprise security. The exploitation corresponds to Account Manipulation under Tactic Defense Evasion and Credential Access, specifically mirroring behaviors associated with Email Forwarding Rules (T1114) and Valid Accounts (T1078). By altering forwarding rules or gaining co-ownership, the attacker establishes persistence and facilitates lateral movement across digital identities. The lack of audit trails for such high-privilege changes further exacerbates the risk, allowing malicious activities to proceed undetected until significant damage has occurred.
To mitigate this vulnerability, immediate patching to FreeMail version 5.3.2 or later is required as it addresses these authorization logic errors. In environments where upgrading is not immediately feasible, administrators should implement strict input validation on the POST /api/create endpoint to ensure that only users with explicit administrative roles can perform mailbox assignments. Additionally, implementing multi-factor authentication for all user accounts reduces the value of intercepted verification codes. Enabling comprehensive logging and monitoring for changes in mailbox ownership or forwarding rules will also aid in early detection of such unauthorized access attempts, ensuring that any exploitation activity is flagged before it leads to full account compromise.