CVE-2026-119049

FreeMail versions prior to 5.3.2 are vulnerable to an authorization bypass in the POST /api/create endpoint. This flaw allows authenticated users who know a victim's email address to claim that existing mailbox. By leveraging the assignMailboxToUser function, an attacker can become a co-owner, gr...