CVE-2026-119049— FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

Quick assessment

Affected

idinging FreeMail

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeMail 5.3.2 之前的版本存在一个授权绕过漏洞，允许已认证用户通过 POST /api/create 接口接管其他用户现有的邮箱。攻击者若知晓受害者的邮箱地址，即可利用 assignMailboxToUser 功能成为该邮箱的共有人，从而读取邮件和验证码、设置邮件转发以及删除邮件。

CVSS 7.6 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

Source: CVE Program / CVE List V5

Vulnerability Description

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.

Source: CVE Program / CVE List V5