FreeMail vulnerabilities

1 known vulnerability in FreeMail from Idinging. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  FreeMail: Authorization Bypass Through User-Controlled Key

  CVE-2026-119049Oct 29, 2026Idinging

  FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToU