Authorization Bypass Vulnerability in FreeMail Product by idinging

CVE-2026-119049

What is CVE-2026-119049?

FreeMail, prior to version 5.3.2, is susceptible to an authorization bypass issue that permits authenticated users to claim ownership of another user's mailbox. This vulnerability is exploited through the POST /api/create endpoint, enabling attackers who are aware of a victim's email address to assume control of the mailbox. Once co-ownership is established via the assignMailboxToUser function, attackers can access private messages, obtain verification codes, modify forwarding settings, and delete emails, posing significant risks to user privacy and data security.

References