Summary
FreeMail contains an authorization bypass in the mailbox creation endpoint that may allow an authenticated user to claim an existing mailbox associated with another user.
By supplying a known victim address, an attacker could become a co-owner and access messages, verification codes, forwarding settings, and mailbox deletion functions.
FreeMail contains an authorization bypass in the mailbox creation endpoint that may allow an authenticated user to claim an existing mailbox associated with another user.
By supplying a known victim address, an attacker could become a co-owner and access messages, verification codes, forwarding settings, and mailbox deletion functions.
Affected context
The issue occurs in FreeMail deployments where the POST /api/create endpoint permits mailbox ownership changes through assignMailboxToUser without sufficiently verifying that the requesting user is authorized to claim the specified mailbox. Exploitation depends on the endpoint being reachable by authenticated users and on the victim's mailbox address being discoverable or guessable.
The issue occurs in FreeMail deployments where the POST /api/create endpoint permits mailbox ownership changes through assignMailboxToUser without sufficiently verifying that the requesting user is authorized to claim the specified mailbox. Exploitation depends on the endpoint being reachable by authenticated users and on the victim's mailbox address being discoverable or guessable.
Exploit preconditions
- Attack surface: The authenticated
POST /api/createmailbox-management API - Required access: A valid FreeMail user account
- Known information: The target user's mailbox address
- Trigger point: Processing a mailbox-claim or ownership-assignment request
- Why exploitation is possible: Authorization checks do not adequately confirm that the requester is permitted to assign the existing mailbox to their account
- Attack surface: The authenticated
POST /api/createmailbox-management API - Required access: A valid FreeMail user account
- Known information: The target user's mailbox address
- Trigger point: Processing a mailbox-claim or ownership-assignment request
- Why exploitation is possible: Authorization checks do not adequately confirm that the requester is permitted to assign the existing mailbox to their account
Why this happens
The vulnerability is caused by insufficient object-level authorization when processing a user-controlled mailbox identifier or address. The application appears to treat knowledge of a valid mailbox address as sufficient to perform an ownership-related action, rather than independently verifying the requester's relationship to that mailbox.
This maps to CWE-639: Authorization Bypass Through User-Controlled Key, where an attacker manipulates an identifier that references another user's resource and the server fails to enforce ownership or access-control requirements.
The vulnerability is caused by insufficient object-level authorization when processing a user-controlled mailbox identifier or address. The application appears to treat knowledge of a valid mailbox address as sufficient to perform an ownership-related action, rather than independently verifying the requester's relationship to that mailbox.
This maps to CWE-639: Authorization Bypass Through User-Controlled Key, where an attacker manipulates an identifier that references another user's resource and the server fails to enforce ownership or access-control requirements.
Potential impact
- An attacker may gain co-owner access to another user's mailbox
- Private messages and verification codes could be exposed
- Mail forwarding settings could be changed without authorization
- Existing mail could be deleted
- Account recovery or secondary-service compromise could become possible
- Mailbox integrity and availability could be affected
- An attacker may gain co-owner access to another user's mailbox
- Private messages and verification codes could be exposed
- Mail forwarding settings could be changed without authorization
- Existing mail could be deleted
- Account recovery or secondary-service compromise could become possible
- Mailbox integrity and availability could be affected
General mitigation guidance
Mitigation generally focuses on enforcing server-side, object-level authorization for every mailbox operation.
Common defensive patterns include:
- Verifying mailbox ownership and permitted relationships independently of user-supplied identifiers
- Requiring explicit, authenticated consent from the current mailbox owner for ownership changes
- Separating mailbox discovery, sharing, and ownership-transfer workflows
- Denying access by default when the requester-to-mailbox relationship is ambiguous
- Using opaque, non-guessable resource identifiers where appropriate, without treating obscurity as authorization
- Applying least privilege to mailbox-management operations
- Auditing ownership changes, forwarding updates, and destructive actions
- Limiting access to messages and verification codes according to narrowly scoped permissions
Mitigation generally focuses on enforcing server-side, object-level authorization for every mailbox operation.
Common defensive patterns include:
- Verifying mailbox ownership and permitted relationships independently of user-supplied identifiers
- Requiring explicit, authenticated consent from the current mailbox owner for ownership changes
- Separating mailbox discovery, sharing, and ownership-transfer workflows
- Denying access by default when the requester-to-mailbox relationship is ambiguous
- Using opaque, non-guessable resource identifiers where appropriate, without treating obscurity as authorization
- Applying least privilege to mailbox-management operations
- Auditing ownership changes, forwarding updates, and destructive actions
- Limiting access to messages and verification codes according to narrowly scoped permissions
How teams detect issues like this
Detection approaches commonly include:
- Static analysis and code review rules for endpoints that use client-supplied identifiers to select authorization targets
- Tests that attempt cross-user access to mailbox creation, sharing, forwarding, and deletion operations
- Review of authorization middleware and service-layer checks for consistent ownership validation
- Policy enforcement requiring explicit authorization checks before resource mutation
- Monitoring for unusual mailbox claims, ownership changes, forwarding updates, and bulk deletion activity
- Automated application security testing that exercises horizontal privilege-boundary violations
Detection approaches commonly include:
- Static analysis and code review rules for endpoints that use client-supplied identifiers to select authorization targets
- Tests that attempt cross-user access to mailbox creation, sharing, forwarding, and deletion operations
- Review of authorization middleware and service-layer checks for consistent ownership validation
- Policy enforcement requiring explicit authorization checks before resource mutation
- Monitoring for unusual mailbox claims, ownership changes, forwarding updates, and bulk deletion activity
- Automated application security testing that exercises horizontal privilege-boundary violations
