Description
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| idinging | FreeMail | < 5.3.2 | 5.3.2 |
References
- GitHub Issue #73 issue-tracking
- https://github.com/idinging/freemail product
- https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1 patch
- FreeMail v5.3.2 Release Notes release-notes
- https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163 technical-description
- VulnCheck Advisory: FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming third-party-advisory