FreeScout is a self‑hosted help desk and shared mailbox system. The vulnerability resides in the profile form, which exposes the only_assigned_tickets permission to users who are not administrators. The UsersController::profileSave() routine can add or remove that permission without confirming that the editor holds administrative privileges. As a result a restricted agent can uncheck the option or submit a profile save that intentionally omits it, removing the administrator‑imposed restriction. Once this permission is cleared, the agent can read and modify conversations assigned to other agents across any mailbox the agent belongs to.

The affected product is Freescout help desk, version 1.8.230 and earlier. The issue is fixed in releases starting at 1.8.231. Users on any earlier release that have the only_assigned_tickets permission exposed in the profile form are vulnerable.

The CVSS score of 7.1 indicates a high severity with a medium to high likelihood of successful exploitation. The EPSS score is not available, and the vulnerability is not listed in CISA's known exploited vulnerabilities catalog. Because the flaw is triggered by performing a profile save, the likely attack vector is local or internal; an attacker must already have a non‑admin account with privileges to edit their own profile. Once exploited, the attacker gains read and write access to all conversations assigned to other agents in the same mailbox, compromising confidentiality and integrity of those communications.