{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/freemail/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:freemail:freemail:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-119049"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeMail (\u003c 5.3.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FreeMail"],"content_html":"\u003cp\u003eFreeMail versions prior to 5.3.2 are susceptible to an authorization bypass vulnerability within the /api/create endpoint. An authenticated attacker can leverage the assignMailboxToUser function to associate an existing, victim-owned mailbox with their own account. This unauthorized association grants the attacker the ability to read messages, intercept verification codes, modify mail forwarding settings, and delete arbitrary messages from the compromised mailbox.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthorized access to a victim's mailbox. Potential impact includes account takeovers via password resets (due to interception of verification codes) and exfiltration of sensitive communications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade FreeMail to version 5.3.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for the /api/create endpoint to identify anomalous mailbox assignment patterns, specifically multiple associations for the same mailbox identifier.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:37:30Z","date_published":"2026-10-29T15:37:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-freemail-auth-bypass/","summary":"FreeMail versions before 5.3.2 contain an authorization bypass vulnerability allowing authenticated users to claim ownership of other mailboxes via the assignMailboxToUser functionality.","title":"FreeMail: Authorization bypass in /api/create (CVE-2026-119049)","url":"https://feed.craftedsignal.io/briefs/2026-10-freemail-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeMail","version":"https://jsonfeed.org/version/1.1"}