Vendor
FreeMail versions before 5.3.2 contain an authorization bypass vulnerability allowing authenticated users to claim ownership of other mailboxes via the assignMailboxToUser functionality.