FreeMail: Authorization bypass in /api/create (CVE-2026-119049)

FreeMail versions prior to 5.3.2 are susceptible to an authorization bypass vulnerability within the /api/create endpoint. An authenticated attacker can leverage the assignMailboxToUser function to associate an existing, victim-owned mailbox with their own account. This unauthorized association grants the attacker the ability to read messages, intercept verification codes, modify mail forwarding settings, and delete arbitrary messages from the compromised mailbox.

Impact

Successful exploitation results in full unauthorized access to a victim's mailbox. Potential impact includes account takeovers via password resets (due to interception of verification codes) and exfiltration of sensitive communications.

Recommendation

• Upgrade FreeMail to version 5.3.2 or later immediately.
• Audit logs for the /api/create endpoint to identify anomalous mailbox assignment patterns, specifically multiple associations for the same mailbox identifier.