CVE-2026-119049

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

CVE-2026-119049

FreeMail versions prior to 5.3.2 are vulnerable to an authorization bypass in the POST /api/create endpoint. This flaw allows authenticated users who know a victim's email address to claim that existing mailbox. By leveraging the assignMailboxToUser function, an attacker can become a co-owner, gr...

EUVD-2026-112815

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

MAL-2025-6795 Malicious code in productboard-freemail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a6e97fd17d98afb5fe43af9593d6e212069bdd9fcf008969bb1773d097e22b7 The OpenSSF Package Analysis project identified 'productboard-freemail' @ 10086.0.1113 npm as malicious. It is considered malicious because: - T...

Unfixed XSS vulnerability at www.netwizz.de

Security researcher T-Ping, has submitted on 18/09/2007 a cross-site-scripting XSS vulnerability affecting www.netwizz.de, which at the time of submission ranked 1697456 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/09/2007. It is currentl...

gmx-xss.txt

hello everybody, recently, i've detected that gmx, a german freemail-provider it offers professional services too is prone to a xss-vulnerability. An attacker could send an email containing these string: Because gmx-webmail displays html-mails also, you can color the code white so that the...