FreeMail (< 5.3.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/freemail--5.3.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:37:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFreeMail: Authorization bypass in /api/create (CVE-2026-119049)https://feed.craftedsignal.io/briefs/2026-10-freemail-auth-bypass/Thu, 29 Oct 2026 15:37:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-freemail-auth-bypass/FreeMail versions before 5.3.2 contain an authorization bypass vulnerability allowing authenticated users to claim ownership of other mailboxes via the assignMailboxToUser functionality.FreeMail versions prior to 5.3.2 are susceptible to an authorization bypass vulnerability within the /api/create endpoint. An authenticated attacker can leverage the assignMailboxToUser function to associate an existing, victim-owned mailbox with their own account. This unauthorized association grants the attacker the ability to read messages, intercept verification codes, modify mail forwarding settings, and delete arbitrary messages from the compromised mailbox.

Impact

Successful exploitation results in full unauthorized access to a victim's mailbox. Potential impact includes account takeovers via password resets (due to interception of verification codes) and exfiltration of sensitive communications.

Recommendation

  • Upgrade FreeMail to version 5.3.2 or later immediately.
  • Audit logs for the /api/create endpoint to identify anomalous mailbox assignment patterns, specifically multiple associations for the same mailbox identifier.
]]>highadvisory