Description
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
idinging FreeMail
Default version status: unaffected
0 to < 5.3.2affected
References
- https://github.com/idinging/freemail/issues/73 ↗
- https://github.com/idinging/freemail ↗
- https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1 ↗
- https://github.com/idinging/freemail/releases/tag/v5.3.2 ↗
- https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163 ↗
- https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming ↗