Threats tagged 'ghsa-7mjv-78r5-wjqw'

FreeMail versions prior to 5.3.2 have an authorization bypass vulnerability that allows authenticated users to claim mailboxes belonging to other users. By exploiting the POST /api/create endpoint, an attacker who knows another user's email address can become a co-owner of that mailbox. This unauthorized access enables reading messages and verification codes, setting mail forwarding, and deleting mail. The vulnerability is tracked as CVE-2026-119049 with a high severity score of 7.6.